hellokitty | 501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe

Resubmissions

15/04/2025, 13:36

250415-qv874syvfs 10

20/07/2021, 12:44

210720-8qm4c8n1dn 10

11/02/2021, 21:49

210211-jqg53q9bbn 10

Analysis

max time kernel
272s
max time network
278s
platform
windows10_x64
resource
win10v20210410
submitted
20/07/2021, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Hi_Kitty_2.exe
Size

157KB
MD5

136bd70f7aa98f52861879d7dca03cf2
SHA1

fadd8d7c13a18c251ded1f645ffea18a37f1c2de
SHA256

501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe
SHA512

919b81c6e062f26fef9f2f02f60af9493795ab1e74be0977210375598d2a17e37add7f7843f94c7cd6c44ba12af777a478c3744692ece2e31864b6aafd37e8df

Score

10^/10

hellokitty ransomware

Malware Config

Extracted

Path

C:\Boot\bg-BG\read_me_lkd.txt

Ransom Note

Hello dear user. Your files have been encrypted. -- What does it mean?! Content of your files have been modified. Without special key you can't undo that operation. -- How to get special key? If you want to get it, you must pay us some money and we will help you. We will give you special decryption program and instructions. -- Ok, how i can pay you? 1) Download TOR browser, if you don't know how to do it you can google it. 2) Open this website in tor browser: http://6x7dp6h3w6q3ugjv4yv5gycj3femb24kysgry5b44hhgfwc5ml5qrdad.onion/d87c3f9baf85b2e9ab2a824bb78868294e19992e2e26b54f248abfa73c42a7c0 3) Follow instructions in chat.

URLs

http://6x7dp6h3w6q3ugjv4yv5gycj3femb24kysgry5b44hhgfwc5ml5qrdad.onion/d87c3f9baf85b2e9ab2a824bb78868294e19992e2e26b54f248abfa73c42a7c0

Signatures

HelloKitty Ransomware
Ransomware family which has been active since late 2020, and in early 2021 a variant compromised the CDProjektRed game studio.
ransomware hellokitty

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\BlockConnect.tiff	Hi_Kitty_2.exe
File opened for modification	C:\Users\Admin\Pictures\OutWatch.tiff	Hi_Kitty_2.exe
File renamed	C:\Users\Admin\Pictures\BlockConnect.tiff => C:\Users\Admin\Pictures\BlockConnect.tiff.crypted	Hi_Kitty_2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 64 IoCs

evasion

pid	Process
9164	taskkill.exe
7500	taskkill.exe
7424	taskkill.exe
7296	taskkill.exe
7232	taskkill.exe
13848	taskkill.exe
4100	taskkill.exe
7164	taskkill.exe
7392	taskkill.exe
5224	taskkill.exe
4864	taskkill.exe
13288	taskkill.exe
3580	taskkill.exe
6428	taskkill.exe
13560	taskkill.exe
9868	taskkill.exe
6056	taskkill.exe
11100	taskkill.exe
6668	taskkill.exe
1912	taskkill.exe
13316	taskkill.exe
6124	taskkill.exe
8184	taskkill.exe
7484	taskkill.exe
7328	taskkill.exe
11072	taskkill.exe
7048	taskkill.exe
4976	taskkill.exe
7240	taskkill.exe
13680	taskkill.exe
13896	taskkill.exe
5004	taskkill.exe
5536	taskkill.exe
9308	taskkill.exe
11064	taskkill.exe
10328	taskkill.exe
7256	taskkill.exe
4932	taskkill.exe
5248	taskkill.exe
3920	taskkill.exe
10364	taskkill.exe
4708	taskkill.exe
1200	taskkill.exe
7456	taskkill.exe
9780	taskkill.exe
7288	taskkill.exe
11088	taskkill.exe
10420	taskkill.exe
6472	taskkill.exe
7528	taskkill.exe
4200	taskkill.exe
11468	taskkill.exe
3476	taskkill.exe
13264	taskkill.exe
13356	taskkill.exe
7248	taskkill.exe
8380	taskkill.exe
7512	taskkill.exe
8916	taskkill.exe
10452	taskkill.exe
6972	taskkill.exe
6540	taskkill.exe
6944	taskkill.exe
4904	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe
3912	Hi_Kitty_2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3912	Hi_Kitty_2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	taskkill.exe
Token: SeDebugPrivilege	2356	taskkill.exe
Token: SeDebugPrivilege	2060	taskkill.exe
Token: SeDebugPrivilege	1916	taskkill.exe
Token: SeDebugPrivilege	3060	taskkill.exe
Token: SeDebugPrivilege	2884	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	192	taskkill.exe
Token: SeDebugPrivilege	3988	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	3848	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	4100	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	4272	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	7164	taskkill.exe
Token: SeDebugPrivilege	5644	taskkill.exe
Token: SeDebugPrivilege	7156	taskkill.exe
Token: SeDebugPrivilege	5364	taskkill.exe
Token: SeDebugPrivilege	5056	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	5548	net1.exe
Token: SeDebugPrivilege	7264	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	7520	taskkill.exe
Token: SeDebugPrivilege	7376	taskkill.exe
Token: SeDebugPrivilege	7176	taskkill.exe
Token: SeDebugPrivilege	7328	taskkill.exe
Token: SeDebugPrivilege	7272	taskkill.exe
Token: SeDebugPrivilege	7280	taskkill.exe
Token: SeDebugPrivilege	7256	taskkill.exe
Token: SeDebugPrivilege	7304	taskkill.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeDebugPrivilege	7240	taskkill.exe
Token: SeDebugPrivilege	7368	taskkill.exe
Token: SeDebugPrivilege	4904	taskkill.exe
Token: SeDebugPrivilege	7416	taskkill.exe
Token: SeDebugPrivilege	7424	taskkill.exe
Token: SeDebugPrivilege	7352	taskkill.exe
Token: SeDebugPrivilege	7432	taskkill.exe
Token: SeDebugPrivilege	7456	taskkill.exe
Token: SeDebugPrivilege	7408	taskkill.exe
Token: SeDebugPrivilege	7500	taskkill.exe
Token: SeDebugPrivilege	7392	taskkill.exe
Token: SeDebugPrivilege	7440	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	7528	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	4380	taskkill.exe
Token: SeDebugPrivilege	7288	taskkill.exe
Token: SeDebugPrivilege	8388	taskkill.exe
Token: SeDebugPrivilege	8356	taskkill.exe
Token: SeDebugPrivilege	7248	taskkill.exe
Token: SeDebugPrivilege	5076	taskkill.exe
Token: SeDebugPrivilege	7484	taskkill.exe
Token: SeDebugPrivilege	7384	taskkill.exe
Token: SeDebugPrivilege	7232	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 1916	3912	Hi_Kitty_2.exe	75
PID 3912 wrote to memory of 1916	3912	Hi_Kitty_2.exe	75
PID 3912 wrote to memory of 1916	3912	Hi_Kitty_2.exe	75
PID 3912 wrote to memory of 2060	3912	Hi_Kitty_2.exe	76
PID 3912 wrote to memory of 2060	3912	Hi_Kitty_2.exe	76
PID 3912 wrote to memory of 2060	3912	Hi_Kitty_2.exe	76
PID 3912 wrote to memory of 2356	3912	Hi_Kitty_2.exe	82
PID 3912 wrote to memory of 2356	3912	Hi_Kitty_2.exe	82
PID 3912 wrote to memory of 2356	3912	Hi_Kitty_2.exe	82
PID 3912 wrote to memory of 2500	3912	Hi_Kitty_2.exe	80
PID 3912 wrote to memory of 2500	3912	Hi_Kitty_2.exe	80
PID 3912 wrote to memory of 2500	3912	Hi_Kitty_2.exe	80
PID 3912 wrote to memory of 2720	3912	Hi_Kitty_2.exe	81
PID 3912 wrote to memory of 2720	3912	Hi_Kitty_2.exe	81
PID 3912 wrote to memory of 2720	3912	Hi_Kitty_2.exe	81
PID 3912 wrote to memory of 3060	3912	Hi_Kitty_2.exe	84
PID 3912 wrote to memory of 3060	3912	Hi_Kitty_2.exe	84
PID 3912 wrote to memory of 3060	3912	Hi_Kitty_2.exe	84
PID 3912 wrote to memory of 2884	3912	Hi_Kitty_2.exe	87
PID 3912 wrote to memory of 2884	3912	Hi_Kitty_2.exe	87
PID 3912 wrote to memory of 2884	3912	Hi_Kitty_2.exe	87
PID 3912 wrote to memory of 192	3912	Hi_Kitty_2.exe	88
PID 3912 wrote to memory of 192	3912	Hi_Kitty_2.exe	88
PID 3912 wrote to memory of 192	3912	Hi_Kitty_2.exe	88
PID 3912 wrote to memory of 3988	3912	Hi_Kitty_2.exe	95
PID 3912 wrote to memory of 3988	3912	Hi_Kitty_2.exe	95
PID 3912 wrote to memory of 3988	3912	Hi_Kitty_2.exe	95
PID 3912 wrote to memory of 3580	3912	Hi_Kitty_2.exe	91
PID 3912 wrote to memory of 3580	3912	Hi_Kitty_2.exe	91
PID 3912 wrote to memory of 3580	3912	Hi_Kitty_2.exe	91
PID 3912 wrote to memory of 4056	3912	Hi_Kitty_2.exe	94
PID 3912 wrote to memory of 4056	3912	Hi_Kitty_2.exe	94
PID 3912 wrote to memory of 4056	3912	Hi_Kitty_2.exe	94
PID 3912 wrote to memory of 1200	3912	Hi_Kitty_2.exe	96
PID 3912 wrote to memory of 1200	3912	Hi_Kitty_2.exe	96
PID 3912 wrote to memory of 1200	3912	Hi_Kitty_2.exe	96
PID 3912 wrote to memory of 3920	3912	Hi_Kitty_2.exe	634
PID 3912 wrote to memory of 3920	3912	Hi_Kitty_2.exe	634
PID 3912 wrote to memory of 3920	3912	Hi_Kitty_2.exe	634
PID 3912 wrote to memory of 3848	3912	Hi_Kitty_2.exe	100
PID 3912 wrote to memory of 3848	3912	Hi_Kitty_2.exe	100
PID 3912 wrote to memory of 3848	3912	Hi_Kitty_2.exe	100
PID 3912 wrote to memory of 2872	3912	Hi_Kitty_2.exe	101
PID 3912 wrote to memory of 2872	3912	Hi_Kitty_2.exe	101
PID 3912 wrote to memory of 2872	3912	Hi_Kitty_2.exe	101
PID 3912 wrote to memory of 4100	3912	Hi_Kitty_2.exe	102
PID 3912 wrote to memory of 4100	3912	Hi_Kitty_2.exe	102
PID 3912 wrote to memory of 4100	3912	Hi_Kitty_2.exe	102
PID 3912 wrote to memory of 4204	3912	Hi_Kitty_2.exe	105
PID 3912 wrote to memory of 4204	3912	Hi_Kitty_2.exe	105
PID 3912 wrote to memory of 4204	3912	Hi_Kitty_2.exe	105
PID 3912 wrote to memory of 4272	3912	Hi_Kitty_2.exe	110
PID 3912 wrote to memory of 4272	3912	Hi_Kitty_2.exe	110
PID 3912 wrote to memory of 4272	3912	Hi_Kitty_2.exe	110
PID 3912 wrote to memory of 4356	3912	Hi_Kitty_2.exe	107
PID 3912 wrote to memory of 4356	3912	Hi_Kitty_2.exe	107
PID 3912 wrote to memory of 4356	3912	Hi_Kitty_2.exe	107
PID 3912 wrote to memory of 4424	3912	Hi_Kitty_2.exe	108
PID 3912 wrote to memory of 4424	3912	Hi_Kitty_2.exe	108
PID 3912 wrote to memory of 4424	3912	Hi_Kitty_2.exe	108
PID 3912 wrote to memory of 4524	3912	Hi_Kitty_2.exe	465
PID 3912 wrote to memory of 4524	3912	Hi_Kitty_2.exe	465
PID 3912 wrote to memory of 4524	3912	Hi_Kitty_2.exe	465
PID 3912 wrote to memory of 4592	3912	Hi_Kitty_2.exe	116

C:\Users\Admin\AppData\Local\Temp\Hi_Kitty_2.exe
"C:\Users\Admin\AppData\Local\Temp\Hi_Kitty_2.exe"
1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im mysql*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im dsa*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im ds_monitor*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im Notifier*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im Ntrtscan*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im TmListen*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im iVPAgent*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im CNTAoSMgr*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:192
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im bes10*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3580
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im black*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im IBM*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3988
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im robo*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im store.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im sql*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im vee*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wrsa*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im postg*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im sage*
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wrsa.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4272
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSSQLServerADHelper100
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100
    3⤵
    PID:4124
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSSQL$ISARS
  2⤵
  PID:4592
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQL$ISARS
    3⤵
    PID:4764
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SQLAgent$ISARS
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$ISARS
    3⤵
    PID:4860
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SQLAgent$MSFW
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLAgent$MSFW
    3⤵
    PID:5212
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SQLWriter
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SQLWriter
    3⤵
    PID:5448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop WinDefend
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:5436
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop mr2kserv
  2⤵
  PID:5004
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSExchangeADTopology
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeADTopology
    3⤵
    PID:5764
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSExchangeFBA
  2⤵
  PID:5088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeFBA
    3⤵
    PID:5704
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSExchangeSA
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSExchangeSA
    3⤵
    PID:5892
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop ShadowProtectSvc
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop ShadowProtectSvc
    3⤵
    PID:5952
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SPWriterV4
  2⤵
  PID:5532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop SPWriterV4
    3⤵
    PID:6732
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSSQLServerADHelper100
  2⤵
  PID:5648
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop MSSQLServerADHelper100
    3⤵
    PID:7016
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop IISADMIN
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop IISADMIN
    3⤵
    PID:5544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QBCFMonitorService
  2⤵
  PID:5928
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBCFMonitorService
    3⤵
    PID:5064
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QBVSS
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBVSS
    3⤵
    PID:4792
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QBPOSDBServiceV12
  2⤵
  PID:6040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QBPOSDBServiceV12
    3⤵
    PID:5816
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB4
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB4
    3⤵
    PID:5876
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB18
  2⤵
  PID:6272
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB18
    3⤵
    PID:7552
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB24
  2⤵
  PID:6512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB24
    3⤵
    PID:4896
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB23
  2⤵
  PID:6500
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB23
    3⤵
    PID:7744
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB22
  2⤵
  PID:6492
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB22
    3⤵
    PID:5320
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB21
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB21
    3⤵
    PID:7344
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB20
  2⤵
  PID:6472
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB20
    3⤵
    PID:7360
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB25
  2⤵
  PID:6524
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB25
    3⤵
    PID:7716
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB19
  2⤵
  PID:6456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB19
    3⤵
    PID:7336
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "2516"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7156
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "2516"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5644
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "2516"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7164
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4680"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mr2kserv
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5140"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5140"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5140"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5380"
  2⤵
  PID:8432
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5380"
  2⤵
  PID:8424
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5380"
  2⤵
  PID:8416
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5304"
  2⤵
  PID:8404
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5304"
  2⤵
  PID:8396
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5304"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:8388
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5260"
  2⤵
  - Kills process with taskkill
  PID:8380
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5260"
  2⤵
  PID:8372
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5260"
  2⤵
  PID:8364
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5200"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:8356
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5200"
  2⤵
  PID:8348
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5200"
  2⤵
  PID:8340
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5460"
  2⤵
  PID:8640
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5596"
  2⤵
  - Kills process with taskkill
  PID:8184
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5648"
  2⤵
  PID:5972
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5596"
  2⤵
  - Kills process with taskkill
  PID:9164
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5596"
  2⤵
  PID:9152
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5532"
  2⤵
  PID:9144
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5532"
  2⤵
  PID:9136
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5532"
  2⤵
  PID:8884
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5716"
  2⤵
  PID:5200
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5716"
  2⤵
  PID:9180
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5648"
  2⤵
  PID:5840
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5648"
  2⤵
  PID:5308
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5716"
  2⤵
  - Kills process with taskkill
  PID:5536
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5460"
  2⤵
  PID:8856
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5460"
  2⤵
  PID:8624
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5796"
  2⤵
  - Kills process with taskkill
  PID:9308
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5796"
  2⤵
  PID:9448
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5796"
  2⤵
  PID:9420
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4448"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7528
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4448"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7520
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4448"
  2⤵
  - Kills process with taskkill
  PID:7512
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5088"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7500
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5088"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7484
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5088"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7456
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5040"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7440
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5040"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7432
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5040"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7424
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5004"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7416
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5004"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7408
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5004"
  2⤵
  PID:7400
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4920"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7392
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4920"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7384
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4920"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7376
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4876"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7368
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4876"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7352
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5928"
  2⤵
  PID:5408
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5928"
  2⤵
  - Kills process with taskkill
  PID:4200
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3040
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5928"
  2⤵
  PID:6408
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5856"
  2⤵
  - Kills process with taskkill
  PID:9868
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5988"
  2⤵
  PID:5908
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5856"
  2⤵
  PID:9788
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5856"
  2⤵
  - Kills process with taskkill
  PID:9780
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5988"
  2⤵
  PID:5444
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4876"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7328
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4840"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7304
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4840"
  2⤵
  - Kills process with taskkill
  PID:7296
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4840"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7288
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4788"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7280
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5988"
  2⤵
  - Kills process with taskkill
  PID:4932
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4788"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7272
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6040"
  2⤵
  PID:5580
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6112"
  2⤵
  PID:6348
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6132"
  2⤵
  PID:8660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7344
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6140"
  2⤵
  - Kills process with taskkill
  PID:6056
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6132"
  2⤵
  PID:8924
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6132"
  2⤵
  - Kills process with taskkill
  PID:8916
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5136"
  2⤵
  PID:6840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6484
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6212"
  2⤵
  PID:10444
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6220"
  2⤵
  PID:10772
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6232"
  2⤵
  PID:10888
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6272"
  2⤵
  - Kills process with taskkill
  PID:11100
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6456"
  2⤵
  - Kills process with taskkill
  PID:11468
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6272"
  2⤵
  - Kills process with taskkill
  PID:11088
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6272"
  2⤵
  PID:11080
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6260"
  2⤵
  - Kills process with taskkill
  PID:11072
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6260"
  2⤵
  - Kills process with taskkill
  PID:11064
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6260"
  2⤵
  PID:11056
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6248"
  2⤵
  PID:11048
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6248"
  2⤵
  PID:11032
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6248"
  2⤵
  PID:11024
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6232"
  2⤵
  PID:10816
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6232"
  2⤵
  PID:10808
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6220"
  2⤵
  PID:10800
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6220"
  2⤵
  - Kills process with taskkill
  PID:10452
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6212"
  2⤵
  PID:10436
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6212"
  2⤵
  PID:10428
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6196"
  2⤵
  - Kills process with taskkill
  PID:10420
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6196"
  2⤵
  PID:10412
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6196"
  2⤵
  PID:10404
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6456"
  2⤵
  PID:11992
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6188"
  2⤵
  PID:10396
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6188"
  2⤵
  PID:10388
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6188"
  2⤵
  PID:10380
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6180"
  2⤵
  PID:10372
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6180"
  2⤵
  - Kills process with taskkill
  PID:10364
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6180"
  2⤵
  - Kills process with taskkill
  PID:10328
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6456"
  2⤵
  PID:12504
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "3476"
  2⤵
  PID:6400
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "3476"
  2⤵
  - Kills process with taskkill
  PID:7048
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "3476"
  2⤵
  - Kills process with taskkill
  PID:6668
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5496"
  2⤵
  PID:4912
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5496"
  2⤵
  PID:6872
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5496"
  2⤵
  - Kills process with taskkill
  PID:5248
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5424"
  2⤵
  PID:7064
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5424"
  2⤵
  - Kills process with taskkill
  PID:5224
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5424"
  2⤵
  PID:4672
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5148"
  2⤵
  PID:5440
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5148"
  2⤵
  - Kills process with taskkill
  PID:6972
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5148"
  2⤵
  - Kills process with taskkill
  PID:1912
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5232"
  2⤵
  PID:4656
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5232"
  2⤵
  - Kills process with taskkill
  PID:4864
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5232"
  2⤵
  - Kills process with taskkill
  PID:4708
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5136"
  2⤵
  PID:6548
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5136"
  2⤵
  PID:7012
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5096"
  2⤵
  - Kills process with taskkill
  PID:6472
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6472"
  2⤵
  PID:12940
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5096"
  2⤵
  - Kills process with taskkill
  PID:3476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB9
    3⤵
    PID:7200
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "5096"
  2⤵
  PID:6248
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6140"
  2⤵
  - Kills process with taskkill
  PID:6540
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6140"
  2⤵
  PID:6204
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6124"
  2⤵
  PID:8868
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6124"
  2⤵
  - Kills process with taskkill
  PID:6944
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6124"
  2⤵
  PID:5148
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6112"
  2⤵
  PID:7004
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6112"
  2⤵
  PID:6196
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6104"
  2⤵
  - Kills process with taskkill
  PID:6428
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6472"
  2⤵
  PID:13220
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6104"
  2⤵
  PID:5856
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6104"
  2⤵
  - Kills process with taskkill
  PID:4976
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6472"
  2⤵
  - Kills process with taskkill
  PID:13264
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6484"
  2⤵
  - Kills process with taskkill
  PID:13288
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6484"
  2⤵
  - Kills process with taskkill
  PID:13316
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6096"
  2⤵
  PID:5668
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6096"
  2⤵
  PID:5724
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6096"
  2⤵
  PID:6308
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6040"
  2⤵
  - Kills process with taskkill
  PID:6124
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Simply Accounting Database Connection Manager"
    3⤵
    PID:4844
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6040"
  2⤵
  PID:6140
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop QuickBooksDB2
    3⤵
    PID:4676
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6484"
  2⤵
  - Kills process with taskkill
  PID:13356
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6492"
  2⤵
  PID:13396
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6492"
  2⤵
  PID:13444
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4788"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7264
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4716"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7256
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6492"
  2⤵
  PID:13500
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4716"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7248
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6500"
  2⤵
  - Kills process with taskkill
  PID:13560
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4716"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7240
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4680"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7232
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6500"
  2⤵
  PID:13624
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6500"
  2⤵
  - Kills process with taskkill
  PID:13680
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6512"
  2⤵
  PID:13720
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4680"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:7176
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6512"
  2⤵
  PID:13792
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6512"
  2⤵
  - Kills process with taskkill
  PID:13848
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6524"
  2⤵
  - Kills process with taskkill
  PID:13896
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4632"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6524"
  2⤵
  PID:13952
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4632"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "6524"
  2⤵
  PID:14004
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4632"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4592"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4592"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4592"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4524"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4524"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5364
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /PID "4524"
  2⤵
  PID:5548
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB17
  2⤵
  PID:6260
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB16
  2⤵
  PID:6248
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB15
  2⤵
  PID:6232
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB14
  2⤵
  PID:6220
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB13
  2⤵
  PID:6212
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB12
  2⤵
  PID:6196
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB11
  2⤵
  PID:6188
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB10
  2⤵
  PID:6180
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB9
  2⤵
  PID:3476
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB8
  2⤵
  PID:5496
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB7
  2⤵
  PID:5424
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB6
  2⤵
  PID:5148
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB5
  2⤵
  PID:5232
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB3
  2⤵
  PID:5096
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB2
  2⤵
  PID:6140
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop QuickBooksDB1
  2⤵
  PID:6132
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "Simply Accounting Database Connection Manager"
  2⤵
  PID:6124
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop IISADMIN
  2⤵
  PID:6112
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
  2⤵
  PID:6104
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "IBM Domino Server(CProgramFilesIBMDominodata)"
  2⤵
  PID:6096
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop ibmiasrw
  2⤵
  PID:5856
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop firebirdguardiandefaultinstance
  2⤵
  PID:5796
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SPSearch4
  2⤵
  PID:5596
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SPUserCodeV4
  2⤵
  PID:5460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SPTraceV4
  2⤵
  PID:5380
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SPTimerV4
  2⤵
  PID:5304
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SPAdminV4
  2⤵
  PID:5260
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSExchangeIS
  2⤵
  PID:4448
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop ReportServer$ISARS
  2⤵
  PID:4840
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop SQLBrowser
  2⤵
  PID:4788
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop MSSQL$MSFW
  2⤵
  PID:4632
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im copy*
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SQLBrowser
1⤵
PID:5324

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SPAdminV4
1⤵
PID:5972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop firebirdguardiandefaultinstance
1⤵
PID:7092

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SPSearch4
1⤵
PID:6748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB6
1⤵
PID:4644

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB12
1⤵
PID:4748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ibmiasrw
1⤵
PID:5448

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB11
1⤵
PID:3040

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB16
1⤵
PID:4976

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB17
1⤵
PID:7568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB15
1⤵
PID:7560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB10
1⤵
PID:7320

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6456

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6524

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB14
1⤵
PID:5316

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB8
1⤵
PID:5176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB13
1⤵
PID:4972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB7
1⤵
PID:4836

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IBM Domino Server(CProgramFilesIBMDominodata)"
1⤵
PID:5828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop IISADMIN
1⤵
PID:4852

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB5
1⤵
PID:7056

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB3
1⤵
PID:4900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop QuickBooksDB1
1⤵
PID:4940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "IBM Domino Diagnostics(CProgramFilesIBMDomino)"
1⤵
PID:4616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SPTraceV4
1⤵
PID:6740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SPUserCodeV4
1⤵
PID:6724

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6400

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop SPTimerV4
1⤵
PID:6064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSExchangeIS
1⤵
PID:5636

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop ReportServer$ISARS
1⤵
PID:5408

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop MSSQL$MSFW
1⤵
PID:5188

\??\c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:15844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads