Trojan.Encoder.33187

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateCheck' = '<Full path to file>'

Creates or modifies the following files

%APPDATA%\microsoft\windows\start menu\programs\hjkdfs\lgfkkiubsdh.exe
%HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41

Creates the following files on removable media

<Drive name for removable media>:\.c4d1664ef40ce18f8d41
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\archer.avi
<Drive name for removable media>:\dial.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\sdksampleprivdeveloper.cer
<Drive name for removable media>:\contosoroot.cer

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop U8WorkerService1
'%WINDIR%\syswow64\net.exe' stop TPlusStdTaskService1220
'%WINDIR%\syswow64\net.exe' stop MSExchangeThrottling
'%WINDIR%\syswow64\net.exe' stop 360EntPGSvc
'%WINDIR%\syswow64\net.exe' stop TPlusStdAppService1220
'%WINDIR%\syswow64\net.exe' stop MSExchangeSubmission
'%WINDIR%\syswow64\net.exe' stop ServiceMid
'%WINDIR%\syswow64\net.exe' stop MySQL
'%WINDIR%\syswow64\net.exe' stop MSExchangeServiceHost
'%WINDIR%\syswow64\net.exe' stop tmlisten
'%WINDIR%\syswow64\net.exe' stop OracleDBConsoleilas
'%WINDIR%\syswow64\net.exe' stop MSExchangeRPC
'%WINDIR%\syswow64\net.exe' stop VeeamDistributionSvc
'%WINDIR%\syswow64\net.exe' stop "OracleOraDb10g_homeliSQL*Plus"
'%WINDIR%\syswow64\net.exe' stop MSExchangeRepl
'%WINDIR%\syswow64\net.exe' stop ClickToRunSvc
'%WINDIR%\syswow64\net.exe' stop VeeamBrokerSvc
'%WINDIR%\syswow64\net.exe' stop MSExchangePOP3BE
'%WINDIR%\syswow64\net.exe' stop VeeamMountSvc
'%WINDIR%\syswow64\net.exe' stop CASVirtualDiskService
'%WINDIR%\syswow64\net.exe' stop MSExchangePop3
'%WINDIR%\syswow64\net.exe' stop VeeamCloudSvc
'%WINDIR%\syswow64\net.exe' stop VeeamDeploySvc
'%WINDIR%\syswow64\net.exe' stop iNethinkSQLBackupSvc
'%WINDIR%\syswow64\net.exe' stop MSExchangeNotificationsBroker
'%WINDIR%\syswow64\net.exe' stop VeeamNFSSvc
'%WINDIR%\syswow64\net.exe' stop DDNSService
'%WINDIR%\syswow64\net.exe' stop MSExchangeMailboxReplication
'%WINDIR%\syswow64\net.exe' stop TPlusStdWebService1300
'%WINDIR%\syswow64\net.exe' stop TPlusStdUpgradeService1300
'%WINDIR%\syswow64\net.exe' stop RapService
'%WINDIR%\syswow64\net.exe' stop CASMsgSrv
'%WINDIR%\syswow64\net.exe' stop OMAILREPORT
'%WINDIR%\syswow64\net.exe' stop DFServ
'%WINDIR%\syswow64\net.exe' stop RavTask
'%WINDIR%\syswow64\net.exe' stop "ABBYY.Licensing.FineReader.Professional.12.0"
'%WINDIR%\syswow64\net.exe' stop "Apple Mobile Device Service"
'%WINDIR%\syswow64\taskkill.exe' /IM Att.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM httpd.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM mysqld.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM iexplore.exe /F
'%WINDIR%\syswow64\net.exe' stop "Bonjour Service"
'%WINDIR%\syswow64\net.exe' stop U8SendMailAdmin
'%WINDIR%\syswow64\net.exe' stop pcas
'%WINDIR%\syswow64\net.exe' stop KugouService
'%WINDIR%\syswow64\net.exe' stop ceng_web_svc_d
'%WINDIR%\syswow64\net.exe' stop KpService
'%WINDIR%\syswow64\net.exe' stop K3MMainSuspendService
'%WINDIR%\syswow64\net.exe' stop SupportAssistAgent
'%WINDIR%\syswow64\net.exe' stop MSExchangeMailboxAssistants
'%WINDIR%\syswow64\net.exe' stop "Dell Hardware Support"
'%WINDIR%\syswow64\net.exe' stop RavService
'%WINDIR%\syswow64\net.exe' stop AutoUpdatePatchService
'%WINDIR%\syswow64\net.exe' stop "NetVault Process Manager"
'%WINDIR%\syswow64\net.exe' stop ImtsEventSvr
'%WINDIR%\syswow64\net.exe' stop MySQL5_OA
'%WINDIR%\syswow64\net.exe' stop NFLicenceServer
'%WINDIR%\syswow64\net.exe' stop DDVRulesProcessor
'%WINDIR%\syswow64\net.exe' stop MSExchangeUMCR
'%WINDIR%\syswow64\net.exe' stop d_safe
'%WINDIR%\syswow64\net.exe' stop "FileZilla Server"
'%WINDIR%\syswow64\net.exe' stop MSExchangeUM
'%WINDIR%\syswow64\net.exe' stop AngelOfDeath
'%WINDIR%\syswow64\net.exe' stop K3MobileServiceManage
'%WINDIR%\syswow64\net.exe' stop MSExchangeTransportLogSearch
'%WINDIR%\syswow64\net.exe' stop MSExchangeTransport
'%WINDIR%\syswow64\net.exe' stop TPlusStdUpgradeService1220
'%WINDIR%\syswow64\net.exe' stop TPlusStdTaskService1300
'%WINDIR%\syswow64\net.exe' stop JWEM3DBAUTORun
'%WINDIR%\syswow64\net.exe' stop VMnetDHCP
'%WINDIR%\syswow64\net.exe' stop MSExchangeCompliance
'%WINDIR%\syswow64\net.exe' stop DellDRLogSvc
'%WINDIR%\syswow64\net.exe' stop mysqltransport
'%WINDIR%\syswow64\net.exe' stop MSExchangeAntispamUpdate
'%WINDIR%\syswow64\net.exe' stop "Synology Drive VSS Service x64"
'%WINDIR%\syswow64\net.exe' stop WebAttendServer
'%WINDIR%\syswow64\net.exe' stop MSExchangeADTopology
'%WINDIR%\syswow64\net.exe' stop Apache2.2
'%WINDIR%\syswow64\net.exe' stop wanxiao-monitor
'%WINDIR%\syswow64\net.exe' stop MSComplianceAudit
'%WINDIR%\syswow64\net.exe' stop XenSvc
'%WINDIR%\syswow64\net.exe' stop VMAuthdService
'%WINDIR%\syswow64\net.exe' stop UFIDAWebService
'%WINDIR%\syswow64\net.exe' stop FirebirdGuardianDeafaultInstance
'%WINDIR%\syswow64\net.exe' stop xenlite
'%WINDIR%\syswow64\net.exe' stop Apache2.4
'%WINDIR%\syswow64\net.exe' stop Realtek11nSU
'%WINDIR%\syswow64\net.exe' stop TeamViewer8
'%WINDIR%\syswow64\net.exe' stop "memcached Server"
'%WINDIR%\syswow64\net.exe' stop "igfxCUIService2.0.0.0"
'%WINDIR%\syswow64\net.exe' stop VMwareHostd
'%WINDIR%\syswow64\net.exe' stop U8WorkerService2
'%WINDIR%\syswow64\net.exe' stop HaoZipSvc
'%WINDIR%\syswow64\taskkill.exe' /IM ThunderPlatform.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM pg_ctl.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM BackupExec.exe /F
'%WINDIR%\syswow64\net.exe' stop UIODetect
'%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F
'%WINDIR%\syswow64\taskkill.exe' /IM VBoxSDS.exe /F
'%WINDIR%\syswow64\net.exe' stop VMUSBArbService
'%WINDIR%\syswow64\net.exe' stop CASWebServer
'%WINDIR%\syswow64\net.exe' stop MSExchangeIS
'%WINDIR%\syswow64\net.exe' stop "VMware NAT Service"
'%WINDIR%\syswow64\net.exe' stop TPlusStdAppService1300
'%WINDIR%\syswow64\net.exe' stop CASXMLService
'%WINDIR%\syswow64\net.exe' stop MSExchangeIMAP4BE
'%WINDIR%\syswow64\net.exe' stop VeeamTransportSvc
'%WINDIR%\syswow64\net.exe' stop "AliyunService"
'%WINDIR%\syswow64\net.exe' stop MSExchangeImap4
'%WINDIR%\syswow64\net.exe' stop VeeanBackupSvc
'%WINDIR%\syswow64\net.exe' stop "Alibaba Security Aegis Update Service"
'%WINDIR%\syswow64\net.exe' stop MSExchangeHMRecovery
'%WINDIR%\syswow64\net.exe' stop "Alibaba Security Aegis Detect Service"
'%WINDIR%\syswow64\net.exe' stop VeeamCatalogSvc
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQL2008
'%WINDIR%\syswow64\net.exe' stop AutoUpdateService
'%WINDIR%\syswow64\net.exe' stop AdobeARMservice
'%WINDIR%\syswow64\net.exe' stop AGSService
'%WINDIR%\syswow64\net.exe' stop MSExchangeHM
'%WINDIR%\syswow64\net.exe' stop FirebirdServerDefaultInstance
'%WINDIR%\syswow64\net.exe' stop MSExchangeFrontEndTransport
'%WINDIR%\syswow64\net.exe' stop CASLicenceServer
'%WINDIR%\syswow64\net.exe' stop RapidRecoveryAgent
'%WINDIR%\syswow64\net.exe' stop MSExchangeFastSearch
'%WINDIR%\syswow64\net.exe' stop QPCore
'%WINDIR%\syswow64\net.exe' stop Service2
'%WINDIR%\syswow64\net.exe' stop MSExchangeEdgeSync
'%WINDIR%\syswow64\net.exe' stop TeamViewer
'%WINDIR%\syswow64\net.exe' stop JWService
'%WINDIR%\syswow64\net.exe' stop MSExchangeDiagnostics
'%WINDIR%\syswow64\net.exe' stop Tomcat8
'%WINDIR%\syswow64\net.exe' stop JWRinfoClientService
'%WINDIR%\syswow64\net.exe' stop MSExchangeDelivery
'%WINDIR%\syswow64\net.exe' stop MSExchangeDagMgmt
'%WINDIR%\syswow64\net.exe' stop IngressMgr

Modifies file system

Creates the following files

%TEMP%\killer.bat
%HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms
%HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms
%HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms
%HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms
%HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms
%HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms
%HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms
%HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms
%HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms
%HOMEPATH%\recent\customdestinations\how to back your files.txt
%HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms
%HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms
%HOMEPATH%\recent\how to back your files.txt
%HOMEPATH%\saved games\how to back your files.txt
%HOMEPATH%\searches\how to back your files.txt
%HOMEPATH%\sendto\how to back your files.txt
%HOMEPATH%\sendto\mail recipient.mapimail
%HOMEPATH%\sendto\desktop (create shortcut).desklink
%HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget
%HOMEPATH%\start menu\programs\accessories\system tools\how to back your files.txt
%HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms
%HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms
%HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms
%HOMEPATH%\start menu\programs\accessories\accessibility\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\entries\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_
%HOMEPATH%\local settings\thunderbird\profiles\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\updates\8216c80c92c4e828\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\updates\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\how to back your files.txt
%HOMEPATH%\local settings\virtualstore\how to back your files.txt
%HOMEPATH%\local settings\how to back your files.txt
%HOMEPATH%\local settings\iconcache.db
%HOMEPATH%\local settings\gdipfontcachev1.dat
%HOMEPATH%\music\how to back your files.txt
%HOMEPATH%\my documents\how to back your files.txt
%HOMEPATH%\nethood\how to back your files.txt
%HOMEPATH%\pictures\how to back your files.txt
%HOMEPATH%\recent\automaticdestinations\how to back your files.txt
%HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms
%HOMEPATH%\printhood\how to back your files.txt
%HOMEPATH%\start menu\programs\accessories\how to back your files.txt
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache2\doomed\how to back your files.txt
%HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\administrative tools\how to back your files.txt
%HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
%HOMEPATH%\templates\how to back your files.txt
%HOMEPATH%\templates\.c4d1664ef40ce18f8d41
%HOMEPATH%\videos\how to back your files.txt
%HOMEPATH%\videos\.c4d1664ef40ce18f8d41
%HOMEPATH%\voip\how to back your files.txt
%HOMEPATH%\voip\.c4d1664ef40ce18f8d41
%HOMEPATH%\how to back your files.txt
%HOMEPATH%\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\how to back your files.txt
C:\users\how to back your files.txt
C:\how to back your files.txt
z:\system volume information\.c4d1664ef40ce18f8d41
C:\$recycle.bin\.c4d1664ef40ce18f8d41
z:\.c4d1664ef40ce18f8d41
D:\.c4d1664ef40ce18f8d41
C:\.c4d1664ef40ce18f8d41
<Current directory>\ids.txt
%ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
%TEMP%\dvdjfzuwplxcnj.vbs
C:\users\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\how to back your files.txt
%HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\hjkdfs\how to back your files.txt
%HOMEPATH%\start menu\programs\hjkdfs\lgfkkiubsdh.exe
%HOMEPATH%\start menu\programs\hjkdfs\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\icq\how to back your files.txt
%HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\mail.ru\how to back your files.txt
%HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\maintenance\how to back your files.txt
%HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\how to back your files.txt
%HOMEPATH%\start menu\programs\telegram desktop\how to back your files.txt
C:\$recycle.bin\how to back your files.txt
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\total commander\how to back your files.txt
D:\system volume information\.c4d1664ef40ce18f8d41
D:\$recycle.bin\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\winrar\how to back your files.txt
%HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
%HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\cache\_cache_001_

Sets the 'hidden' attribute to the following files

%ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\administrative tools\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\hjkdfs\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\icq\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\mail.ru\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\maintenance\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\startup\.c4d1664ef40ce18f8d41
C:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
D:\$recycle.bin\s-1-5-21-1960123792-2022915161-3775307078-1001\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\telegram desktop\.c4d1664ef40ce18f8d41
<Drive name for removable media>:\.c4d1664ef40ce18f8d41
D:\system volume information\.c4d1664ef40ce18f8d41
D:\$recycle.bin\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\total commander\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
%HOMEPATH%\templates\.c4d1664ef40ce18f8d41
%HOMEPATH%\videos\.c4d1664ef40ce18f8d41
%HOMEPATH%\voip\.c4d1664ef40ce18f8d41
%HOMEPATH%\.c4d1664ef40ce18f8d41
C:\users\.c4d1664ef40ce18f8d41
z:\system volume information\.c4d1664ef40ce18f8d41
D:\.c4d1664ef40ce18f8d41
C:\$recycle.bin\.c4d1664ef40ce18f8d41
z:\.c4d1664ef40ce18f8d41
C:\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\winrar\.c4d1664ef40ce18f8d41
%HOMEPATH%\start menu\programs\accessories\accessibility\.c4d1664ef40ce18f8d41

Moves the following files

from %HOMEPATH%\start menu\programs\hjkdfs\lgfkkiubsdh.exe to %HOMEPATH%\start menu\programs\hjkdfs\lgfkkiubsdh.exe.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\gdipfontcachev1.dat to %HOMEPATH%\local settings\gdipfontcachev1.dat.globeimposter-alpha865qqz
from %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\7e4dca80246863e3.automaticdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\74d7f43c1561fc1e.automaticdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms to %HOMEPATH%\recent\automaticdestinations\1b4dd67f29cb1962.automaticdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms to %HOMEPATH%\recent\customdestinations\c312e260e424ae76.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms to %HOMEPATH%\recent\customdestinations\bf8efb871eda5262.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms to %HOMEPATH%\recent\customdestinations\969252ce11249fdd.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms to %HOMEPATH%\recent\customdestinations\9027fe24326910d2.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\7e4dca80246863e3.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms to %HOMEPATH%\recent\customdestinations\74d7f43c1561fc1e.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5d696d521de238c3.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms to %HOMEPATH%\recent\customdestinations\5afe4de1b92fc382.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms to %HOMEPATH%\recent\customdestinations\590aee7bdd69b59b.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms to %HOMEPATH%\recent\customdestinations\28c8b86deab549a1.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms to %HOMEPATH%\recent\customdestinations\1b4dd67f29cb1962.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms to %HOMEPATH%\recent\customdestinations\10a2479c877ca098.customdestinations-ms.globeimposter-alpha865qqz
from %HOMEPATH%\sendto\mail recipient.mapimail to %HOMEPATH%\sendto\mail recipient.mapimail.globeimposter-alpha865qqz
from %HOMEPATH%\sendto\desktop (create shortcut).desklink to %HOMEPATH%\sendto\desktop (create shortcut).desklink.globeimposter-alpha865qqz
from %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget to %HOMEPATH%\sendto\compressed (zipped) folder.zfsendtotarget.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_ to %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\_cache_clean_.globeimposter-alpha865qqz
from %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little to %HOMEPATH%\local settings\thunderbird\profiles\wjj9aet2.default\startupcache\startupcache.4.little.globeimposter-alpha865qqz

Changes user data files extensions (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\wscript.exe' "%TEMP%\Dvdjfzuwplxcnj.vbs"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\killer.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\killer.bat" "
'%WINDIR%\syswow64\sc.exe' delete GPSMysqld
'%WINDIR%\syswow64\net1.exe' stop VeeamDeploySvc
'%WINDIR%\syswow64\net1.exe' stop iNethinkSQLBackupSvc
'%WINDIR%\syswow64\net1.exe' stop MSExchangeNotificationsBroker
'%WINDIR%\syswow64\sc.exe' delete Mysoft.Autoupgrade.UpdateService
'%WINDIR%\syswow64\sc.exe' delete GPSTomcat6
'%WINDIR%\syswow64\net1.exe' stop VeeamNFSSvc
'%WINDIR%\syswow64\sc.exe' delete Mysoft.Autoupgrade.DispatchService
'%WINDIR%\syswow64\sc.exe' delete Mysoft.Config.WindowsService
'%WINDIR%\syswow64\sc.exe' delete GPSLoginSvr
'%WINDIR%\syswow64\net1.exe' stop MSExchangeMailboxReplication
'%WINDIR%\syswow64\cmd.exe' /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabl...
'%WINDIR%\syswow64\net1.exe' stop TPlusStdWebService1300
'%WINDIR%\syswow64\sc.exe' delete ErpEnvSvc
'%WINDIR%\syswow64\sc.exe' delete GPSMediaSvr
'%WINDIR%\syswow64\net1.exe' stop TPlusStdUpgradeService1300
'%WINDIR%\syswow64\net1.exe' stop RapService
'%WINDIR%\syswow64\net1.exe' stop MSExchangeMailboxAssistants
'%WINDIR%\syswow64\net1.exe' stop DDNSService
'%WINDIR%\syswow64\sc.exe' delete Mysoft.Setup.InstallService
'%WINDIR%\syswow64\net1.exe' stop OracleDBConsoleilas
'%WINDIR%\syswow64\sc.exe' delete Mysoft.DataCenterService
'%WINDIR%\syswow64\net1.exe' stop MSExchangeRPC
'%WINDIR%\syswow64\sc.exe' delete BackupExecDeviceMediaService
'%WINDIR%\syswow64\net1.exe' stop VeeamDistributionSvc
'%WINDIR%\syswow64\sc.exe' delete edr_monitor
'%WINDIR%\syswow64\net1.exe' stop "OracleOraDb10g_homeliSQL*Plus"
'%WINDIR%\syswow64\net1.exe' stop MSExchangeRepl
'%WINDIR%\syswow64\sc.exe' delete MysoftUpdate
'%WINDIR%\syswow64\sc.exe' delete bedbg
'%WINDIR%\syswow64\sc.exe' delete TbossSystem
'%WINDIR%\syswow64\net1.exe' stop VeeamBrokerSvc
'%WINDIR%\syswow64\sc.exe' delete BackupExecAgentAccelerator
'%WINDIR%\syswow64\net1.exe' stop CASMsgSrv
'%WINDIR%\syswow64\net1.exe' stop MSExchangePOP3BE
'%WINDIR%\syswow64\net1.exe' stop VeeamMountSvc
'%WINDIR%\syswow64\sc.exe' delete Mysoft.SchedulingService
'%WINDIR%\syswow64\sc.exe' delete "Zabbix Agent"
'%WINDIR%\syswow64\net1.exe' stop CASVirtualDiskService
'%WINDIR%\syswow64\net1.exe' stop MSExchangePop3
'%WINDIR%\syswow64\net1.exe' stop VeeamCloudSvc
'%WINDIR%\syswow64\sc.exe' delete GPSFtpd
'%WINDIR%\syswow64\sc.exe' delete GPSGatewaySvr
'%WINDIR%\syswow64\sc.exe' delete CobianBackup10
'%WINDIR%\syswow64\net1.exe' stop VeeanBackupSvc
'%WINDIR%\syswow64\net1.exe' stop "Alibaba Security Aegis Update Service"
'%WINDIR%\syswow64\net1.exe' stop MSExchangeHMRecovery
'%WINDIR%\syswow64\sc.exe' delete RaAutoInstSrv_RT2870
'%WINDIR%\syswow64\sc.exe' delete OracleRemExecService
'%WINDIR%\syswow64\sc.exe' delete wampapache
'%WINDIR%\syswow64\net1.exe' stop VeeamCatalogSvc
'%WINDIR%\syswow64\net1.exe' stop "Alibaba Security Aegis Detect Service"
'%WINDIR%\syswow64\sc.exe' delete MSSEARCH
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQL2008
'%WINDIR%\syswow64\sc.exe' delete QQCertificateService
'%WINDIR%\syswow64\sc.exe' delete NFWebServer
'%WINDIR%\syswow64\sc.exe' delete "OSP Service"
'%WINDIR%\syswow64\net1.exe' stop AutoUpdateService
'%WINDIR%\syswow64\net1.exe' stop AdobeARMservice
'%WINDIR%\syswow64\net1.exe' stop MSExchangeHM
'%WINDIR%\syswow64\sc.exe' delete LPManager
'%WINDIR%\syswow64\sc.exe' delete vmware-converter-worker
'%WINDIR%\syswow64\sc.exe' delete MediatekRegistryWriter
'%WINDIR%\syswow64\net1.exe' stop MSExchangeIMAP4BE
'%WINDIR%\syswow64\net1.exe' stop TPlusStdTaskService1300
'%WINDIR%\syswow64\sc.exe' delete msftesql
'%WINDIR%\syswow64\net1.exe' stop AGSService
'%WINDIR%\syswow64\net1.exe' stop MSExchangeIS
'%WINDIR%\syswow64\sc.exe' delete semwebsrv
'%WINDIR%\syswow64\sc.exe' delete GPSDataProcSvr
'%WINDIR%\syswow64\sc.exe' delete SQLService
'%WINDIR%\syswow64\sc.exe' delete GPSStorageSvr
'%WINDIR%\syswow64\sc.exe' delete OracleDBConcoleorcl
'%WINDIR%\syswow64\net1.exe' stop TPlusStdAppService1300
'%WINDIR%\syswow64\sc.exe' delete OracleMTSRecoveryService
'%WINDIR%\syswow64\net1.exe' stop CASXMLService
'%WINDIR%\syswow64\sc.exe' delete CASLicenceServer
'%WINDIR%\syswow64\sc.exe' delete GPSDownSvr
'%WINDIR%\syswow64\sc.exe' delete "SyncBASE Service"
'%WINDIR%\syswow64\net1.exe' stop VeeamTransportSvc
'%WINDIR%\syswow64\net1.exe' stop "AliyunService"
'%WINDIR%\syswow64\net1.exe' stop MSExchangeImap4
'%WINDIR%\syswow64\sc.exe' delete SQLANYs_sem5
'%WINDIR%\syswow64\sc.exe' delete GPSUserSvr
'%WINDIR%\syswow64\sc.exe' delete GPSDaemon
'%WINDIR%\syswow64\sc.exe' delete abs_deployer
'%WINDIR%\syswow64\sc.exe' delete BackupExecRPCService
'%WINDIR%\syswow64\net1.exe' stop tmlisten
'%WINDIR%\syswow64\sc.exe' delete U8SCMPool
'%WINDIR%\syswow64\sc.exe' delete RTCASMCU
'%WINDIR%\syswow64\sc.exe' delete "U8MPool"
'%WINDIR%\syswow64\sc.exe' delete RtcSrv
'%WINDIR%\syswow64\net1.exe' stop SupportAssistAgent
'%WINDIR%\syswow64\sc.exe' delete U8KeyManagePool
'%WINDIR%\syswow64\sc.exe' delete OfficeUpdateService
'%WINDIR%\syswow64\net1.exe' stop "Dell Hardware Support"
'%WINDIR%\syswow64\sc.exe' delete TurboCRM70
'%WINDIR%\syswow64\sc.exe' delete U8GCService
'%WINDIR%\syswow64\sc.exe' delete U8EncryptService
'%WINDIR%\syswow64\sc.exe' delete "Daemon Service"
'%WINDIR%\syswow64\net1.exe' stop OMAILREPORT
'%WINDIR%\syswow64\sc.exe' delete U8EISService
'%WINDIR%\syswow64\sc.exe' delete "Nuo Update Monitor"
'%WINDIR%\syswow64\net1.exe' stop AutoUpdatePatchService
'%WINDIR%\syswow64\sc.exe' delete U8DispatchService
'%WINDIR%\syswow64\net1.exe' stop "NetVault Process Manager"
'%WINDIR%\syswow64\sc.exe' delete asComSvc
'%WINDIR%\syswow64\sc.exe' delete OpenFastAssist
'%WINDIR%\syswow64\net1.exe' stop K3MMainSuspendService
'%WINDIR%\syswow64\net1.exe' stop KugouService
'%WINDIR%\syswow64\net1.exe' stop RavService
'%WINDIR%\syswow64\net1.exe' stop "Apple Mobile Device Service"
'%WINDIR%\syswow64\net1.exe' stop "Bonjour Service"
'%WINDIR%\syswow64\net1.exe' stop U8SendMailAdmin
'%WINDIR%\syswow64\sc.exe' delete "U8WorkerService1"
'%WINDIR%\syswow64\sc.exe' delete UTUService
'%WINDIR%\syswow64\net1.exe' stop pcas
'%WINDIR%\syswow64\sc.exe' delete UFReportService
'%WINDIR%\syswow64\sc.exe' delete U8SLReportService
'%WINDIR%\syswow64\sc.exe' delete FTA
'%WINDIR%\syswow64\sc.exe' delete UFAllNet
'%WINDIR%\syswow64\sc.exe' delete MSCRMUnzipService
'%WINDIR%\syswow64\net1.exe' stop ceng_web_svc_d
'%WINDIR%\syswow64\sc.exe' delete "U8WebPool"
'%WINDIR%\syswow64\sc.exe' delete NscAuthService
'%WINDIR%\syswow64\sc.exe' delete U8TaskService
'%WINDIR%\syswow64\sc.exe' delete MASTER
'%WINDIR%\syswow64\net1.exe' stop KpService
'%WINDIR%\syswow64\sc.exe' delete MSCRMAsyncService$maintenance
'%WINDIR%\syswow64\net1.exe' stop ImtsEventSvr
'%WINDIR%\syswow64\net1.exe' stop MySQL5_OA
'%WINDIR%\syswow64\sc.exe' delete "Rpc Monitor"
'%WINDIR%\syswow64\sc.exe' delete "U8WorkerService2"
'%WINDIR%\syswow64\sc.exe' delete MDM
'%WINDIR%\syswow64\net1.exe' stop TPlusStdTaskService1220
'%WINDIR%\syswow64\net1.exe' stop MSExchangeThrottling
'%WINDIR%\syswow64\sc.exe' delete CloudExchangeService
'%WINDIR%\syswow64\net1.exe' stop 360EntPGSvc
'%WINDIR%\syswow64\sc.exe' delete BackupExecManagementService
'%WINDIR%\syswow64\sc.exe' delete TxQBService
'%WINDIR%\syswow64\sc.exe' delete ShareBoxService
'%WINDIR%\syswow64\net1.exe' stop MSExchangeSubmission
'%WINDIR%\syswow64\sc.exe' delete BackupExecJobEngine
'%WINDIR%\syswow64\net1.exe' stop ServiceMid
'%WINDIR%\syswow64\sc.exe' delete ShareBoxMonitorService
'%WINDIR%\syswow64\sc.exe' delete BackupExecAgentBrowser
'%WINDIR%\syswow64\net1.exe' stop MySQL
'%WINDIR%\syswow64\net1.exe' stop MSExchangeServiceHost
'%WINDIR%\syswow64\sc.exe' delete savsvc
'%WINDIR%\syswow64\net1.exe' stop TPlusStdAppService1220
'%WINDIR%\syswow64\net1.exe' stop MSExchangeTransport
'%WINDIR%\syswow64\net1.exe' stop ClickToRunSvc
'%WINDIR%\syswow64\net1.exe' stop TPlusStdUpgradeService1220
'%WINDIR%\syswow64\net1.exe' stop NFLicenceServer
'%WINDIR%\syswow64\net1.exe' stop MSExchangeUM
'%WINDIR%\syswow64\sc.exe' delete OfficeClearCache
'%WINDIR%\syswow64\sc.exe' delete "EasyFZS Server"
'%WINDIR%\syswow64\net1.exe' stop DDVRulesProcessor
'%WINDIR%\syswow64\net1.exe' stop MSExchangeUMCR
'%WINDIR%\syswow64\sc.exe' delete U8SmsSrv
'%WINDIR%\syswow64\net1.exe' stop d_safe
'%WINDIR%\syswow64\sc.exe' delete Serv-U
'%WINDIR%\syswow64\net1.exe' stop "FileZilla Server"
'%WINDIR%\syswow64\sc.exe' delete YunService
'%WINDIR%\syswow64\sc.exe' delete CIS
'%WINDIR%\syswow64\net1.exe' stop AngelOfDeath
'%WINDIR%\syswow64\sc.exe' delete KICkSvr
'%WINDIR%\syswow64\sc.exe' delete RemoteAssistService
'%WINDIR%\syswow64\net1.exe' stop K3MobileServiceManage
'%WINDIR%\syswow64\net1.exe' stop MSExchangeTransportLogSearch
'%WINDIR%\syswow64\sc.exe' delete EASService
'%WINDIR%\syswow64\net1.exe' stop RavTask
'%WINDIR%\syswow64\sc.exe' delete Gailun_Downloader
'%WINDIR%\syswow64\sc.exe' delete 360EntClientSvc
'%WINDIR%\syswow64\net1.exe' stop "ABBYY.Licensing.FineReader.Professional.12.0"
'%WINDIR%\syswow64\sc.exe' delete "FontCache3.0.0.0"
'%WINDIR%\syswow64\sc.exe' delete vmware-converter-server
'%WINDIR%\syswow64\sc.exe' delete ImeDictUpdateService
'%WINDIR%\syswow64\sc.exe' delete VMTools
'%WINDIR%\syswow64\net1.exe' stop Realtek11nSU
'%WINDIR%\syswow64\net1.exe' stop TeamViewer8
'%WINDIR%\syswow64\sc.exe' delete RTCDATAMCU
'%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client Guard"
'%WINDIR%\syswow64\sc.exe' delete WebAttendServer
'%WINDIR%\syswow64\net1.exe' stop "memcached Server"
'%WINDIR%\syswow64\sc.exe' delete UIODetect
'%WINDIR%\syswow64\sc.exe' delete JhTask
'%WINDIR%\syswow64\sc.exe' delete RTCIMMCU
'%WINDIR%\syswow64\sc.exe' delete ftusbrdsrv
'%WINDIR%\syswow64\sc.exe' delete TCPIDDAService
'%WINDIR%\syswow64\net1.exe' stop "igfxCUIService2.0.0.0"
'%WINDIR%\syswow64\net1.exe' stop VMwareHostd
'%WINDIR%\syswow64\sc.exe' delete QcSoftService
'%WINDIR%\syswow64\net1.exe' stop U8WorkerService2
'%WINDIR%\syswow64\sc.exe' delete RTCMEETINGMCU
'%WINDIR%\syswow64\sc.exe' delete MSSQLServerOLAPService
'%WINDIR%\syswow64\sc.exe' delete MCService
'%WINDIR%\syswow64\sc.exe' delete SPAdminV4
'%WINDIR%\syswow64\net1.exe' stop Apache2.4
'%WINDIR%\syswow64\sc.exe' delete qemu-ga
'%WINDIR%\syswow64\sc.exe' delete VMUSBArbService
'%WINDIR%\syswow64\sc.exe' delete TeamViewer
'%WINDIR%\syswow64\net1.exe' stop XenSvc
'%WINDIR%\syswow64\net1.exe' stop VMAuthdService
'%WINDIR%\syswow64\sc.exe' delete ProjectQueueService16
'%WINDIR%\syswow64\sc.exe' delete wwbizsrv
'%WINDIR%\syswow64\sc.exe' delete VMAuthdService
'%WINDIR%\syswow64\sc.exe' delete ftusbrdwks
'%WINDIR%\syswow64\net1.exe' stop UFIDAWebService
'%WINDIR%\syswow64\sc.exe' delete MSDTC
'%WINDIR%\syswow64\sc.exe' delete ProjectEventService16
'%WINDIR%\syswow64\sc.exe' delete "ZTE FileTranS"
'%WINDIR%\syswow64\sc.exe' delete "wanxiao-monitor"
'%WINDIR%\syswow64\net1.exe' stop xenlite
'%WINDIR%\syswow64\net1.exe' stop VMUSBArbService
'%WINDIR%\syswow64\sc.exe' delete XT800Service_Personal
'%WINDIR%\syswow64\sc.exe' delete VGAuthService
'%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client"
'%WINDIR%\syswow64\sc.exe' delete RTCCDR
'%WINDIR%\syswow64\sc.exe' delete K3MobileService
'%WINDIR%\syswow64\sc.exe' delete SQLSERVERAGENT
'%WINDIR%\syswow64\net1.exe' stop U8WorkerService1
'%WINDIR%\syswow64\sc.exe' delete "UWS LoPriv Services"
'%WINDIR%\syswow64\sc.exe' delete MSCRMAsyncService
'%WINDIR%\syswow64\sc.exe' delete "DAService_TCP"
'%WINDIR%\syswow64\sc.exe' delete "XT800Service_Personal"
'%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @t...
'%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill...
'%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_ma...
'%WINDIR%\syswow64\net1.exe' stop UIODetect
'%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & ...
'%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer ...
'%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Servi...
'%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop ...
'%WINDIR%\syswow64\cmd.exe' /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDA...
'%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusb...
'%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc ...
'%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc d...
'%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete Qc...
'%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingser...
'%WINDIR%\syswow64\sc.exe' delete SQLBrowser
'%WINDIR%\syswow64\sc.exe' delete MSSQLSERVER
'%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1ClrAgent
'%WINDIR%\syswow64\sc.exe' delete "UtilDev Web Server Pro"
'%WINDIR%\syswow64\sc.exe' delete RtcQms
'%WINDIR%\syswow64\sc.exe' delete UI0Detect
'%WINDIR%\syswow64\sc.exe' delete OracleServiceORCL
'%WINDIR%\syswow64\sc.exe' delete MSSQLFDLauncher
'%WINDIR%\syswow64\sc.exe' delete FxService
'%WINDIR%\syswow64\sc.exe' delete RTCAVMCU
'%WINDIR%\syswow64\sc.exe' delete EnergyDataService
'%WINDIR%\syswow64\sc.exe' delete aspnet_state @sc delete Redis
'%WINDIR%\syswow64\sc.exe' delete OracleVssWriterORCL
'%WINDIR%\syswow64\sc.exe' delete ftnlses3
'%WINDIR%\syswow64\sc.exe' delete RTCATS
'%WINDIR%\syswow64\sc.exe' delete eCardMPService
'%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1TNSListener
'%WINDIR%\syswow64\sc.exe' delete SQLWriter
'%WINDIR%\syswow64\sc.exe' delete ftnlsv3
'%WINDIR%\syswow64\sc.exe' delete REPLICA
'%WINDIR%\syswow64\sc.exe' delete "eCard-TTransServer"
'%WINDIR%\syswow64\net1.exe' stop HaoZipSvc
'%WINDIR%\syswow64\net1.exe' stop MSComplianceAudit
'%WINDIR%\syswow64\sc.exe' delete ReportServer
'%WINDIR%\syswow64\net1.exe' stop wanxiao-monitor
'%WINDIR%\syswow64\net1.exe' stop MSExchangeEdgeSync
'%WINDIR%\syswow64\sc.exe' delete TPlusStdUpgradeService1300
'%WINDIR%\syswow64\sc.exe' delete MotionBoardRCService57
'%WINDIR%\syswow64\sc.exe' delete btPanel
'%WINDIR%\syswow64\sc.exe' delete MSMQ
'%WINDIR%\syswow64\sc.exe' delete TPlusStdTaskService1300
'%WINDIR%\syswow64\net1.exe' stop TeamViewer
'%WINDIR%\syswow64\net1.exe' stop JWService
'%WINDIR%\syswow64\sc.exe' delete MSSQL$SQL2008
'%WINDIR%\syswow64\net1.exe' stop MSExchangeDiagnostics
'%WINDIR%\syswow64\sc.exe' delete KMSELDI
'%WINDIR%\syswow64\sc.exe' delete SQLTELEMETRY
'%WINDIR%\syswow64\sc.exe' delete SQLAgent$SQL2008
'%WINDIR%\syswow64\sc.exe' delete ADWS
'%WINDIR%\syswow64\sc.exe' delete KuaiYunTools
'%WINDIR%\syswow64\sc.exe' delete secbizsrv
'%WINDIR%\syswow64\net1.exe' stop Tomcat8
'%WINDIR%\syswow64\net1.exe' stop JWRinfoClientService
'%WINDIR%\syswow64\sc.exe' delete MotionBoard57
'%WINDIR%\syswow64\net1.exe' stop MSExchangeDelivery
'%WINDIR%\syswow64\net1.exe' stop Service2
'%WINDIR%\syswow64\net1.exe' stop CASLicenceServer
'%WINDIR%\syswow64\sc.exe' delete 360EntSvc
'%WINDIR%\syswow64\net1.exe' stop CASWebServer
'%WINDIR%\syswow64\net1.exe' stop FirebirdServerDefaultInstance
'%WINDIR%\syswow64\net1.exe' stop MSExchangeFrontEndTransport
'%WINDIR%\syswow64\sc.exe' delete LMS
'%WINDIR%\syswow64\sc.exe' delete "FlexNet Licensing Service 64"
'%WINDIR%\syswow64\sc.exe' delete vmware-converter-agent
'%WINDIR%\syswow64\sc.exe' delete 360EntHttpServer
'%WINDIR%\syswow64\sc.exe' delete smtpsvrJT
'%WINDIR%\syswow64\net1.exe' stop QPCore
'%WINDIR%\syswow64\net1.exe' stop RapidRecoveryAgent
'%WINDIR%\syswow64\net1.exe' stop MSExchangeFastSearch
'%WINDIR%\syswow64\sc.exe' delete VisualSVNServer
'%WINDIR%\syswow64\sc.exe' delete 2345PicSvc
'%WINDIR%\syswow64\sc.exe' delete zyb_sync
'%WINDIR%\syswow64\sc.exe' delete VirboxWebServer
'%WINDIR%\syswow64\sc.exe' delete vsvnjobsvc
'%WINDIR%\syswow64\sc.exe' delete Protect_2345Explorer
'%WINDIR%\syswow64\sc.exe' delete jhi_service
'%WINDIR%\syswow64\sc.exe' delete AppFabricCachingService
'%WINDIR%\syswow64\sc.exe' delete MsDtsServer100
'%WINDIR%\syswow64\sc.exe' delete Jenkins
'%WINDIR%\syswow64\sc.exe' delete kbasesrv
'%WINDIR%\syswow64\sc.exe' delete VmAgentDaemon
'%WINDIR%\syswow64\sc.exe' delete "Kiwi Syslog Server"
'%WINDIR%\syswow64\sc.exe' delete "AHS SERVICE"
'%WINDIR%\syswow64\net1.exe' stop "Synology Drive VSS Service x64"
'%WINDIR%\syswow64\net1.exe' stop WebAttendServer
'%WINDIR%\syswow64\sc.exe' delete SPTimerV4
'%WINDIR%\syswow64\net1.exe' stop MSExchangeAntispamUpdate
'%WINDIR%\syswow64\sc.exe' delete ZTEVdservice
'%WINDIR%\syswow64\net1.exe' stop MSExchangeADTopology
'%WINDIR%\syswow64\sc.exe' delete "Flash Helper Service"
'%WINDIR%\syswow64\sc.exe' delete RabbitMQ
'%WINDIR%\syswow64\sc.exe' delete SPSearchHostController
'%WINDIR%\syswow64\sc.exe' delete AlibabaProtect
'%WINDIR%\syswow64\sc.exe' delete VMwareHostd
'%WINDIR%\syswow64\sc.exe' delete allpass_redisservice_port21160
'%WINDIR%\syswow64\net1.exe' stop Apache2.2
'%WINDIR%\syswow64\sc.exe' delete "vm-agent"
'%WINDIR%\syswow64\sc.exe' delete "Sense Shield Service"
'%WINDIR%\syswow64\sc.exe' delete SPTraceV4
'%WINDIR%\syswow64\net1.exe' stop mysqltransport
'%WINDIR%\syswow64\sc.exe' delete TPlusStdAppService1300
'%WINDIR%\syswow64\sc.exe' delete OracleJobSchedulerORCL
'%WINDIR%\syswow64\net1.exe' stop "VMware NAT Service"
'%WINDIR%\syswow64\net1.exe' stop JWEM3DBAUTORun
'%WINDIR%\syswow64\net1.exe' stop MSExchangeDagMgmt
'%WINDIR%\syswow64\sc.exe' delete c2wts
'%WINDIR%\syswow64\sc.exe' delete IpOverUsbSvc
'%WINDIR%\syswow64\sc.exe' delete apachezt
'%WINDIR%\syswow64\sc.exe' delete SSSyncService
'%WINDIR%\syswow64\sc.exe' delete ProjectCalcService16
'%WINDIR%\syswow64\sc.exe' delete eSightService
'%WINDIR%\syswow64\net1.exe' stop DellDRLogSvc
'%WINDIR%\syswow64\net1.exe' stop VMnetDHCP
'%WINDIR%\syswow64\net1.exe' stop FirebirdGuardianDeafaultInstance
'%WINDIR%\syswow64\net1.exe' stop MSExchangeCompliance
'%WINDIR%\syswow64\sc.exe' delete SSMonitorService
'%WINDIR%\syswow64\sc.exe' delete OSearch16
'%WINDIR%\syswow64\sc.exe' delete MMRHookService
'%WINDIR%\syswow64\sc.exe' delete OpenSSHd
'%WINDIR%\syswow64\sc.exe' delete "UWS HiPriv Services"
'%WINDIR%\syswow64\sc.exe' delete BestSyncSvc
'%WINDIR%\syswow64\net1.exe' stop DFServ

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial