Overview

overview

10

Static

static

10

build-x64-...in.exe

windows7_x64

10

build-x64-...in.exe

windows10_x64

10

Resubmissions

23-09-2020 10:35

200923-mkwlt9yalx 10

23-07-2020 14:59

200723-mtbw6t99d2 10

23-07-2020 13:47

200723-5t3mhtw95x 10

Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    23-09-2020 10:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    build-x64-crypt.bin.exe

  • Size

    52KB

  • MD5

    8cc13fea61cc0ba1382a779ee46726f0

  • SHA1

    bd8ef46a02085153605a87fcc047f7ef3d0c4131

  • SHA256

    eeb8a83d7532797d39d060ffb2a65562e8d803c4dbd8379289f99367cac2f850

  • SHA512

    2f317f04b6bda9af58b049cb9bd0032d08c0aa30b8ac8d76b10f738ab11f4cc9f4eca4af3ecf26e610715117e2d68e5f8fb0ac139e60e882cc24fc795bf0a34a

Score
10/10
ransomwareevasionexorcistpersistence

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\ArlomQ-decrypt.hta

Family

exorcist

Ransom Note
ArlomQ Decrypt All your data has been encrypted with Exorcist Ransomware. Do not worry: you have some hours to contact us and decrypt your data by paying a ransom. To do this, follow instructions on this web site: http://217.8.117.26/pay Also, you can install Tor Browser and use this web site: http://4dnd3utjsmm2zcsb.onion/pay IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data! Your authorization key: lxW9+z277KhRHN3GT048nvwO7mSAujfiEk28LUWcdG9AfhwiVro46HXsiGhNjBiR cozXDg6PCKGvDM2xoiusQ95HhJktkNiLCgOJV6R0bp/KbiPZMTQ1uhtXgvJfTxg4 hgwKJ5jsY7pQv5k+Pl9oUQvrWIpv7B3YNZvrRwN5NB5uLC8Uf/M0gwYIA/yhd5Cd 8coEyD02NLNiFJWpVy8MG/470s5lmAXrydIoqNymSbqVQ5OAUICc8QwvmNU0NgTw ZDrbNhEkphVjA2Ut6f+61cQCPjVnJnZa/O0Ik8xXtXyfLO04jKp1fWONrWXTfFPp TZuThzdkZTeK1vONlzJXEueQzBfMTViJ3VvNzCgU2HwspbdRDj7Q1fssACBNbYcd 2B8kz8qZdEebHtmh4DiS24AZpjZDNR+gLCDYaxa0Cke5HMkDg2noWeOES8JRROgq 6fL9iBEXOBxZZgJIFpsCrLPRwXUdU0VkhV/SGTFz3EjWdXcP95M04vnaBoKCBDsC EtYHIztcVftfHUqNO0FYCYGw5bvnJIeubH87p8dRCPkmBPbS88cgSOuTuTS7Pzei DOjsc/deSVLOIGFs7VRk4jQUMa2l938ZO0j+nWKYhlj1w5eSLFHPqBQoxRjTMWfs wL4dDKikXbk2JfUx2DO6k7R/qAEexlmGYoC4eDNzCS1dDqijJTN5EVu0L3JfecEE 9kiNJ6l22pLCd941vqbgWrYcOxAHeF9ZUTxlZIgcXHuRo6Yupgy+TU0iQxJADQFf crwdUUAbp6kc4phGg6n673vhyuhJpJcwGuKalefOPjwh25L7o3PfwgDaKrEhJxMg erVIoIfFecur8jv4kkb5poBOSMjkl+zUO3qpuKk9cj9MbGxdqz7F7HQxcXkIRw1x pM0J8CzfyUHjwmNI4utqEGkcjDBszBLaJtUg4qhT44hWoXbDXE6LkGZyXkvR4f6U u9A/ZisZ6H0ibCLGWETPEnjUzT+kTUl+P5wvALkO3CdPw/hehPRPJtuqFdi9Q2F7 //3Vj/L3mUqI5NZ5S896pjEcPQQWgmUxeQHBw51KNm9Oc5AymvsKTjOSouS/pfoX 3wF/ogP6vGxiOP7gAQvdGnQC//FgZi0Zh4ulD3ZZNrGJG2qBxwDz8ony6YUKO0DD HDE1YxDbVUfxJVgMzLseq2xCc4hng6e0o7VdHEgqVELOvLz9UmU3ofan0AEoGq9M irG/CHCvSZqbZXJFuVM/OXgD9+RtR2vN7b1JngbDdwPwWj79uTzNdla0179zphQM n5KbHZWYAmXz1YHPy+fHcyMl9uAob848REF8Xn53+eHBTwloLnMPcMhMqOhhPSJe 5oaBsfymaB5yM5S+mKFIc9Tt39vQsFvHa4/6wyAqjlxzGCwsG4OZusY6v1Dg3DaU oJ5RjltIinufQPDue2BXvfFmBAtelWckFKEMUiUSjGdOoJkxAtuX6e30sQqzYjnW ujfC6BeK+VoKgbxi5xSB2tm60nJU07xqthpjWM/Yvh7PZdC4wkVtqJcWaQXItNKJ fWbpWm5I25BpmFZT8ejlG0SUZACapkIGXe2vbiOYVq4iKeAGSWNyt9X6gSfGjOkw 5EU1I65d5BqY3++7qo8yUi+zDZr111KLduJycdNaKsGhv0DxB8srmTCCet0i8mUv 8Om4T2NNxO8/rXS8wdHh0SmWEejVzS1TAEEqHZbv/JWEmXauZtLcVQS2PtPVLUvV 9R6tmHC80ezMDwz6sFVPqpUw3GrzODzNTMcNYVjLfoZZDZPVG9Y5PDImBXld5oBB ZgjntA0EaydTYcxrZJG1zox88AO0Kc17hWGfnbyP+jiUQ0INgFZ5pR2xEcZXFL1P N8LFEqgmpYklmMyeccDgpT+mMhKEiOEpotVM/QhMRlt5JbrF1oSN8jaoQzlhqMON pOgQsGFaXFDFvAXt6y2tsuFtqXNdlp54C01fp8KUJ/EVvPuBi4sHGL6r/7qynNV6 QZuon2xLKIY5p2Lol6K9dqBN+gyraowHwtv2oZWAQrhOQeloo1UOaycYbNeiZqLQ XLNEpI7qC7h9ruYScjvcRVz3vYzi1SHvcl7n60DCY1XMcc3Cdq1qakPjf8aL77Uv l7j6ZGypRQGprjBMSt+9kNgzwe6nxcrCj0ah5pNxqm8GA9tNPf03zcUZmir9kzg5 LG212DN3bZp45mVcNWdt5YDUin0mrwuX0hYItpAStRu1Vh5qtrGoopG42NEccdW5 Q7q5Zrh+F7tYzBvg8EaQYn1mKVqIN+VhLV1jWrZHpd8bYlUcOLh9R0iGVisZ3GPV mNAWZqWEJNWbqkqkBhhCebOiH0r6F3kbNonxgDTpd7lO3YytRDGFr2SnYwlgz1oe yWzFZK13qwHUKPN6s5NfvnJUe8MsqDIKirWcYDSpuJZa9ZkCVLJdo/d6W36JMRtV rBqzeiR3d+ZTmmUaWdticAMcnzUH6fpQatqphSyuWMTCiOKqEyRLLywqnbuvsqX7 40H/wlnf1NrkWIreUPPLyAjZnrZrd7YQk4Ud1wOOuK1n7dFC/yMTBEKrrzJrYnRd FZaxC13mi2HXXefoKfgACWReQR9n/mQU0Hp1DsLjBRWjm8hBV8Yb6rSRCN9kXBLr C2JtdVymcT0dIKlrPGasuX0qUhAOCIAGpSHZ8EPMr7dX/zgl6O6J4lr31c7wt/r6 QydSxhkobNFKZQe/BjckVQ2EujL6DpSejgvXVWOCqf89cQueBooZfAB/Z276Xt/n ZEKdHhxVRHaJ+eclXIV2ZTAMyCkPR24DTqv58nbJli6e3cIMcOB2M54bDydtILpO bNA1khb+Nzmx5Q5taZu8hISfzYoiq37ZXQT0USpaBPHctVJMf2lEOqh1XAMrnXgT eDEKOCXy+qYrgsVN8Ihu3Jt2Uwfodrx3Nmt1n5pQUQ7jFJocioaBxkkUzIXPdleL vf/mFk/xfeqeDIfujG0+he74m2Sjh6ytZ57gwatg6+a6dER3mXb+W4YTiyPFOZA/ tEJ8GgjmCN1iI/nbdnDEZOubxiBvT4bwkITnMs5jl6/CqvC6QBNXafkjR4AYotgo 5z4GLh+xn8oSKUYUNsptZwakwfY2yJpxjqkjgqAWVuoEceGao3I2l34NebGtsOf8 ceeifqGqyMI053Kop8VWQHo0bUAuGDGhACOpFvHbAg8LtyaCzLiaxTVPit6QhbjK VIavgO/Iryc6DHErpwc+LsK9hS+Wf4aBoWGcg8dmu92vPyzNCvD7LNDY1y9HYitI exKIO4PU5K5ozBZhtU5yO3lF2roR+XvfRrSiPtfRF6NHcX0Dd5P29LqBbG3u0EuP 3INaW9lEE6D230kWMJUWX11SsSmNE3MNqf3BRh6mWf1GuWnxHnbmjbEydHXS90WR si2ckXR5fV3fgVMGkC0Qv1qy9lmYY4D8KBTgo6f6x5Rrpv02Y1H5IV7smxYO3pgP HVRgK3rqxD/7DZtWguphkJvrw2jvi/v1RHvWn4AI1Jl6Elayysl4o/oVGkS7rD2l T21he4WaZ5piB3u4lSiEge2oBBo+RgE6sGAwezx1Hi8L8mpmelo6c60GAF4Vof/d rfS+P1hyiRcZksUKjs7L4TDbeIRv44II+ZnIuNdHlhJ//vcOFPIc1uoofS1iOgWj ZwZ9SGI4AGgEeh/jZ11/QMacEXbZX5SiNCGfmF3RZG04xkvCppWLZRxRmbd6W2a4 l8s+mgi32HRxptoSBwo/yD5Tlvc5NEua68rdTuWhiyKTgDZbpAinCmsleTlk/owK 7AuQvU3qupU121wnfVxcJu/AamriiJ2uyDXSSLG2jL5W52PESl1LG1LgeJxLAA0V FzH1Abpp6r/Ew9JWnPiXbSsfbH8/7BoZYlfuqdxvMuu+jiIiocqwk2/Qgobvraa4 38kSUm91cUnBEmO66pfsObEYCou1sX6SceEjvEUa+MLx/yaur8fMxyCkeS5pH6Iz
URLs

http://217.8.117.26/pay

http://4dnd3utjsmm2zcsb.onion/pay

Signatures

  • Exorcist

    Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.

    ransomwareexorcist
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 28 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Windows directory 6 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 91 IoCs
    evasion
  • NTFS ADS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 332 IoCs
  • Suspicious use of AdjustPrivilegeToken 133 IoCs
  • Suspicious use of WriteProcessMemory 392 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\build-x64-crypt.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C wmic.exe SHADOWCOPY DELETE /nointeractive
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic.exe SHADOWCOPY DELETE /nointeractive
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3016
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:1844
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Windows\system32\wbadmin.exe
        wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:2128
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C bcdedit.exe /set {default} recoveryenabled No
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled No
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2936
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1332
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2556
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C C:\Windows\system32\vssvc.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Windows\system32\VSSVC.exe
        C:\Windows\system32\vssvc.exe
        3⤵
          PID:3744
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM wxServer*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM wxServer*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:272
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM QBFCService*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM QBFCService*
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1772
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM QBVSS*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM QBVSS*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2120
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM sql*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM sql*
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2736
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM msaccess*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM msaccess*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3148
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM mssql*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM mssql*
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2488
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM mysql*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM mysql*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2116
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM wxServerView*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:252
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM wxServerView*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:264
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM sqlmangr*
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3016
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM sqlmangr*
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1756
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C taskkill /F /T /IM RAgui*
        2⤵
          PID:2784
          • C:\Windows\system32\taskkill.exe
            taskkill /F /T /IM RAgui*
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2484
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /C taskkill /F /T /IM supervise*
          2⤵
            PID:1332
            • C:\Windows\system32\taskkill.exe
              taskkill /F /T /IM supervise*
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3984
          • C:\Windows\SYSTEM32\cmd.exe
            cmd /C taskkill /F /T /IM Culture*
            2⤵
              PID:2556
              • C:\Windows\system32\taskkill.exe
                taskkill /F /T /IM Culture*
                3⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2576
            • C:\Windows\SYSTEM32\cmd.exe
              cmd /C taskkill /F /T /IM Defwatch*
              2⤵
                PID:3236
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /T /IM Defwatch*
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3768
              • C:\Windows\SYSTEM32\cmd.exe
                cmd /C taskkill /F /T /IM winword*
                2⤵
                  PID:1312
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /T /IM winword*
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:268
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd /C taskkill /F /T /IM QBW32*
                  2⤵
                    PID:1844
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /T /IM QBW32*
                      3⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2056
                  • C:\Windows\SYSTEM32\cmd.exe
                    cmd /C taskkill /F /T /IM QBDBMgr*
                    2⤵
                      PID:2148
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /T /IM QBDBMgr*
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2476
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd /C taskkill /F /T /IM qbupdate*
                      2⤵
                        PID:3296
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /T /IM qbupdate*
                          3⤵
                          • Kills process with taskkill
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2616
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd /C taskkill /F /T /IM axlbridge*
                        2⤵
                          PID:2576
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /T /IM axlbridge*
                            3⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1584
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd /C taskkill /F /T /IM httpd*
                          2⤵
                            PID:3768
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /T /IM httpd*
                              3⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1604
                          • C:\Windows\SYSTEM32\cmd.exe
                            cmd /C taskkill /F /T /IM fdlauncher*
                            2⤵
                              PID:272
                              • C:\Windows\system32\taskkill.exe
                                taskkill /F /T /IM fdlauncher*
                                3⤵
                                • Kills process with taskkill
                                PID:3016
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd /C taskkill /F /T /IM MsDtSrvr*
                              2⤵
                                PID:2120
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /F /T /IM MsDtSrvr*
                                  3⤵
                                  • Kills process with taskkill
                                  PID:2784
                              • C:\Windows\SYSTEM32\cmd.exe
                                cmd /C taskkill /F /T /IM java*
                                2⤵
                                  PID:2744
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /F /T /IM java*
                                    3⤵
                                      PID:1144
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    cmd /C taskkill /F /T /IM 360se*
                                    2⤵
                                      PID:2616
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /T /IM 360se*
                                        3⤵
                                          PID:2820
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        cmd /C taskkill /F /T /IM 360doctor*
                                        2⤵
                                          PID:1584
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /F /T /IM 360doctor*
                                            3⤵
                                              PID:3236
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            cmd /C taskkill /F /T /IM wdswfsafe*
                                            2⤵
                                              PID:1628
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /F /T /IM wdswfsafe*
                                                3⤵
                                                  PID:2780
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                cmd /C taskkill /F /T /IM fdhost*
                                                2⤵
                                                  PID:2072
                                                  • C:\Windows\system32\taskkill.exe
                                                    taskkill /F /T /IM fdhost*
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:3408
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  cmd /C taskkill /F /T /IM GDscan*
                                                  2⤵
                                                    PID:2112
                                                    • C:\Windows\system32\taskkill.exe
                                                      taskkill /F /T /IM GDscan*
                                                      3⤵
                                                      • Kills process with taskkill
                                                      PID:2960
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    cmd /C taskkill /F /T /IM ZhuDongFangYu*
                                                    2⤵
                                                      PID:3148
                                                      • C:\Windows\system32\taskkill.exe
                                                        taskkill /F /T /IM ZhuDongFangYu*
                                                        3⤵
                                                          PID:972
                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                        cmd /C taskkill /F /T /IM QBDBMgrN*
                                                        2⤵
                                                          PID:348
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /F /T /IM QBDBMgrN*
                                                            3⤵
                                                              PID:268
                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                            cmd /C taskkill /F /T /IM mysqld*
                                                            2⤵
                                                              PID:3100
                                                              • C:\Windows\system32\taskkill.exe
                                                                taskkill /F /T /IM mysqld*
                                                                3⤵
                                                                • Kills process with taskkill
                                                                PID:3640
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd /C taskkill /F /T /IM AutodeskDesktopApp*
                                                              2⤵
                                                                PID:260
                                                                • C:\Windows\system32\taskkill.exe
                                                                  taskkill /F /T /IM AutodeskDesktopApp*
                                                                  3⤵
                                                                  • Kills process with taskkill
                                                                  PID:2480
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd /C taskkill /F /T /IM acwebbrowser*
                                                                2⤵
                                                                  PID:2144
                                                                  • C:\Windows\system32\taskkill.exe
                                                                    taskkill /F /T /IM acwebbrowser*
                                                                    3⤵
                                                                      PID:3528
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    cmd /C taskkill /F /T /IM Creative Cloud*
                                                                    2⤵
                                                                      PID:2132
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /F /T /IM Creative Cloud*
                                                                        3⤵
                                                                          PID:3808
                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                        cmd /C taskkill /F /T /IM Adobe Desktop Service*
                                                                        2⤵
                                                                          PID:1140
                                                                          • C:\Windows\system32\taskkill.exe
                                                                            taskkill /F /T /IM Adobe Desktop Service*
                                                                            3⤵
                                                                            • Kills process with taskkill
                                                                            PID:2744
                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                          cmd /C taskkill /F /T /IM CoreSync*
                                                                          2⤵
                                                                            PID:3104
                                                                            • C:\Windows\system32\taskkill.exe
                                                                              taskkill /F /T /IM CoreSync*
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:348
                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                            cmd /C taskkill /F /T /IM Adobe CEF Helper*
                                                                            2⤵
                                                                              PID:2420
                                                                              • C:\Windows\system32\taskkill.exe
                                                                                taskkill /F /T /IM Adobe CEF Helper*
                                                                                3⤵
                                                                                  PID:3100
                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                cmd /C taskkill /F /T /IM node*
                                                                                2⤵
                                                                                  PID:3744
                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                    taskkill /F /T /IM node*
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:256
                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                  cmd /C taskkill /F /T /IM AdobeIPCBroker*
                                                                                  2⤵
                                                                                    PID:1312
                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                      taskkill /F /T /IM AdobeIPCBroker*
                                                                                      3⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:1784
                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                    cmd /C taskkill /F /T /IM sync-taskbar*
                                                                                    2⤵
                                                                                      PID:1844
                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                        taskkill /F /T /IM sync-taskbar*
                                                                                        3⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:2120
                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                      cmd /C taskkill /F /T /IM sync-worker*
                                                                                      2⤵
                                                                                        PID:2580
                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                          taskkill /F /T /IM sync-worker*
                                                                                          3⤵
                                                                                            PID:280
                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                          cmd /C taskkill /F /T /IM InputPersonalization*
                                                                                          2⤵
                                                                                            PID:2556
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /F /T /IM InputPersonalization*
                                                                                              3⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:2588
                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                            cmd /C taskkill /F /T /IM AdobeCollabSync*
                                                                                            2⤵
                                                                                              PID:3728
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM AdobeCollabSync*
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:1956
                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                              cmd /C taskkill /F /T /IM BrCtrlCntr*
                                                                                              2⤵
                                                                                                PID:2480
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /F /T /IM BrCtrlCntr*
                                                                                                  3⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:1788
                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                cmd /C taskkill /F /T /IM BrCcUxSys*
                                                                                                2⤵
                                                                                                  PID:3528
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM BrCcUxSys*
                                                                                                    3⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:2112
                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                  cmd /C taskkill /F /T /IM SimplyConnectionManager*
                                                                                                  2⤵
                                                                                                    PID:2132
                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                      taskkill /F /T /IM SimplyConnectionManager*
                                                                                                      3⤵
                                                                                                        PID:1800
                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                      cmd /C taskkill /F /T /IM Simply.SystemTrayIcon*
                                                                                                      2⤵
                                                                                                        PID:3296
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /F /T /IM Simply.SystemTrayIcon*
                                                                                                          3⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:3016
                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                        cmd /C taskkill /F /T /IM fbguard*
                                                                                                        2⤵
                                                                                                          PID:268
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /F /T /IM fbguard*
                                                                                                            3⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:1628
                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                          cmd /C taskkill /F /T /IM fbserver*
                                                                                                          2⤵
                                                                                                            PID:3100
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /F /T /IM fbserver*
                                                                                                              3⤵
                                                                                                                PID:2072
                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                              cmd /C taskkill /F /T /IM ONENOTEM*
                                                                                                              2⤵
                                                                                                                PID:3860
                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                  taskkill /F /T /IM ONENOTEM*
                                                                                                                  3⤵
                                                                                                                    PID:1320
                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                  cmd /C taskkill /F /T /IM wrapper*
                                                                                                                  2⤵
                                                                                                                    PID:2820
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /F /T /IM wrapper*
                                                                                                                      3⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:2492
                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                    cmd /C taskkill /F /T /IM DefWatch*
                                                                                                                    2⤵
                                                                                                                      PID:3148
                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                        taskkill /F /T /IM DefWatch*
                                                                                                                        3⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:3152
                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                      cmd /C taskkill /F /T /IM ccEvtMgr*
                                                                                                                      2⤵
                                                                                                                        PID:992
                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                          taskkill /F /T /IM ccEvtMgr*
                                                                                                                          3⤵
                                                                                                                          • Kills process with taskkill
                                                                                                                          PID:260
                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                        cmd /C taskkill /F /T /IM ccSetMgr*
                                                                                                                        2⤵
                                                                                                                          PID:3640
                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                            taskkill /F /T /IM ccSetMgr*
                                                                                                                            3⤵
                                                                                                                              PID:1756
                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                            cmd /C taskkill /F /T /IM SavRoam*
                                                                                                                            2⤵
                                                                                                                              PID:2936
                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                taskkill /F /T /IM SavRoam*
                                                                                                                                3⤵
                                                                                                                                  PID:1656
                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                cmd /C taskkill /F /T /IM Sqlservr*
                                                                                                                                2⤵
                                                                                                                                  PID:3468
                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                    taskkill /F /T /IM Sqlservr*
                                                                                                                                    3⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:3500
                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                  cmd /C taskkill /F /T /IM sqlagent*
                                                                                                                                  2⤵
                                                                                                                                    PID:2484
                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                      taskkill /F /T /IM sqlagent*
                                                                                                                                      3⤵
                                                                                                                                        PID:2152
                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                      cmd /C taskkill /F /T /IM sqladhlp*
                                                                                                                                      2⤵
                                                                                                                                        PID:1140
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /F /T /IM sqladhlp*
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1792
                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                        cmd /C taskkill /F /T /IM Culserver*
                                                                                                                                        2⤵
                                                                                                                                          PID:3104
                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                            taskkill /F /T /IM Culserver*
                                                                                                                                            3⤵
                                                                                                                                              PID:2500
                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                            cmd /C taskkill /F /T /IM RTVscan*
                                                                                                                                            2⤵
                                                                                                                                              PID:3408
                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                taskkill /F /T /IM RTVscan*
                                                                                                                                                3⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                PID:3236
                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                              cmd /C taskkill /F /T /IM sqlbrowser*
                                                                                                                                              2⤵
                                                                                                                                                PID:2476
                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                  taskkill /F /T /IM sqlbrowser*
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2616
                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                  cmd /C taskkill /F /T /IM SQLADHLP*
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4040
                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                      taskkill /F /T /IM SQLADHLP*
                                                                                                                                                      3⤵
                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                      PID:3684
                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                    cmd /C taskkill /F /T /IM QBIDPService*
                                                                                                                                                    2⤵
                                                                                                                                                      PID:68
                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                        taskkill /F /T /IM QBIDPService*
                                                                                                                                                        3⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:256
                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                      cmd /C taskkill /F /T /IM Intuit.QuickBooks.FCS*
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2148
                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                          taskkill /F /T /IM Intuit.QuickBooks.FCS*
                                                                                                                                                          3⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:1784
                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                        cmd /C taskkill /F /T /IM QBCFMonitorService*
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3984
                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                            taskkill /F /T /IM QBCFMonitorService*
                                                                                                                                                            3⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            PID:2120
                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                          cmd /C taskkill /F /T /IM sqlwriter*
                                                                                                                                                          2⤵
                                                                                                                                                            PID:3920
                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                              taskkill /F /T /IM sqlwriter*
                                                                                                                                                              3⤵
                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                              PID:280
                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                            cmd /C taskkill /F /T /IM msmdsrv*
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3744
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /F /T /IM msmdsrv*
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                PID:2588
                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                              cmd /C taskkill /F /T /IM tomcat6*
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1312
                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                  taskkill /F /T /IM tomcat6*
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                  PID:3768
                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                cmd /C taskkill /F /T /IM zhudongfangyu*
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1844
                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                    taskkill /F /T /IM zhudongfangyu*
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                    PID:1788
                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                  cmd /C taskkill /F /T /IM vmware-usbarbitator64*
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:348
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /T /IM vmware-usbarbitator64*
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2120
                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                      cmd /C taskkill /F /T /IM vmware-converter*
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2056
                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                          taskkill /F /T /IM vmware-converter*
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:280
                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                        cmd /C taskkill /F /T /IM dbsrv12*
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2784
                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                            taskkill /F /T /IM dbsrv12*
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:2588
                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                          cmd /C taskkill /F /T /IM dbeng8*
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1144
                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                              taskkill /F /T /IM dbeng8*
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                              PID:3768
                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                            cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3520
                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                3⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                PID:1788
                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$VEEAMSQL2012*
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2672
                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                  taskkill /F /T /IM MSSQL$VEEAMSQL2012*
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                  PID:2120
                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                cmd /C taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:1800
                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                    taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                    PID:280
                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                  cmd /C taskkill /F /T /IM SQLBrowser*
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3016
                                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                      taskkill /F /T /IM SQLBrowser*
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2588
                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                      cmd /C taskkill /F /T /IM SQLWriter*
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1628
                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                          taskkill /F /T /IM SQLWriter*
                                                                                                                                                                                          3⤵
                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                          PID:3768
                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                        cmd /C taskkill /F /T /IM FishbowlMySQL*
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2072
                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                            taskkill /F /T /IM FishbowlMySQL*
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                            PID:1788
                                                                                                                                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                          cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2420
                                                                                                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                              taskkill /F /T /IM MSSQL$MICROSOFT##WID*
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                              PID:2120
                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                            cmd /C taskkill /F /T /IM MySQL57*
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3972
                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                taskkill /F /T /IM MySQL57*
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                PID:280
                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3772
                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                  taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                cmd /C taskkill /F /T /IM MSSQLServerADHelper100*
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                    taskkill /F /T /IM MSSQLServerADHelper100*
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3768
                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                    cmd /C taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3528
                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                        taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                        PID:2484
                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                      cmd /C taskkill /F /T /IM msftesql-Exchange*
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                          taskkill /F /T /IM msftesql-Exchange*
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                        cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2492
                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                            taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                          • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                            cmd /C taskkill /F /T /IM MSSQL$SBSMONITORING*
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                taskkill /F /T /IM MSSQL$SBSMONITORING*
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                              cmd /C taskkill /F /T /IM MSSQL$SHAREPOINT*
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                  taskkill /F /T /IM MSSQL$SHAREPOINT*
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:3768
                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                cmd /C taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                    taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                    cmd /C taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3104
                                                                                                                                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                        taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                      cmd /C taskkill /F /T /IM SQLAgent$SBSMONITORING*
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3408
                                                                                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                          taskkill /F /T /IM SQLAgent$SBSMONITORING*
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                          PID:2780
                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                        cmd /C taskkill /F /T /IM SQLAgent$SHAREPOINT*
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2476
                                                                                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                                                                                            taskkill /F /T /IM SQLAgent$SHAREPOINT*
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Modifies service
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        PID:1056
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\ArlomQ-decrypt.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:992

                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                        Command-Line Interface

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1059

                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                        Modify Existing Service

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1031

                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                        File Deletion

                                                                                                                                                                                                                        3
                                                                                                                                                                                                                        T1107

                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                        1
                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                        Inhibit System Recovery

                                                                                                                                                                                                                        4
                                                                                                                                                                                                                        T1490

                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\ArlomQ-decrypt.hta
                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                        • memory/68-136-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/252-28-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/256-87-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/256-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/260-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/260-74-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/264-29-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/268-71-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/268-41-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/268-106-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/272-52-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/272-15-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/280-153-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/280-163-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/280-173-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/280-93-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/280-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/348-70-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/348-150-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/348-83-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/972-69-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/992-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1140-126-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1140-26-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1140-80-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1144-57-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1144-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1304-176-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1312-88-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1312-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1312-14-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1312-40-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1320-111-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1332-181-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1332-34-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1332-9-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1332-191-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1568-4-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1584-60-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1584-49-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1604-51-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1628-62-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1628-166-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1628-107-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1644-2-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1656-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1756-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1756-31-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1772-17-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1784-89-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1784-188-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1784-139-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1788-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1788-149-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1788-99-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1788-169-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1792-127-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1800-162-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1800-103-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1844-90-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1844-42-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1844-148-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1844-18-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1844-3-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1956-97-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/1956-186-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2056-43-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2056-152-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2072-168-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2072-64-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2072-109-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2112-66-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2112-101-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2116-27-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-19-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-141-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-91-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-54-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2120-151-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2128-5-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2132-102-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2132-78-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2144-76-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2148-20-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2148-44-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2148-138-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2152-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2152-195-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2152-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2420-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2420-84-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2472-22-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2472-6-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2476-45-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2476-194-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2476-132-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2480-98-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2480-75-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2484-124-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2484-189-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2484-33-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2484-179-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2488-25-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2492-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2492-113-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2496-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2500-129-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2556-94-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2556-11-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2556-36-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2568-0-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2576-184-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2576-37-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2576-48-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2580-92-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2588-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2588-145-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2588-175-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2588-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2588-95-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2616-133-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2616-58-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2616-47-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2672-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2736-21-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2744-56-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2744-81-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2780-183-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2780-193-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2780-63-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2784-154-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2784-55-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2784-32-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2820-59-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2820-112-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2936-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2936-7-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/2960-67-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3016-16-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3016-53-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3016-1-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3016-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3016-30-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3016-105-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3100-85-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3100-108-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3100-72-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3104-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3104-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3104-82-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3148-68-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3148-23-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3148-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3152-115-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3236-12-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3236-38-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3236-131-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3236-61-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3296-104-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3296-46-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3356-10-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3408-192-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3408-130-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3408-65-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3408-8-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3468-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3500-123-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3520-158-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3528-77-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3528-178-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3528-100-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3640-118-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3640-73-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3684-135-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3728-96-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3744-144-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3744-86-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3744-13-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-39-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-50-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-157-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-177-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3768-187-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3772-174-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3808-79-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3860-110-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3860-24-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3920-142-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3972-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3984-35-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/3984-140-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                        • memory/4040-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                          Download