Before proceeding to file encryption operations, the ransomware force stops (“kills”) processes listed by process name in a hard-coded list within the encoded strings of the malware. A full list with assessed process function or relationship is provided in Appendix A of this report. While some of the referenced processes appear to relate to security or management software (e.g. Qihoo 360 Safeguard and Microsoft System Center), the majority of the listed processes concern databases (e.g. IBM Tivoli), or ICS-related processes