Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe
-
Size
9.5MB
-
MD5
e6d512680551588927a4be527845d488
-
SHA1
1d4c4fe2f8804313e0db9b58bc58414a5117f688
-
SHA256
9fb32a17637b8291d56b2dfad58469416f146235a37a750587eb1a993063c19d
-
SHA512
f915a973ce546e7d3a3e61e658f478e8c1d9c2d93377f984efc0dede796762fd923866d62bbf67e48aaa92eafb71555e75c6762406765bfd62ba00e1d342df17
-
SSDEEP
196608:TnYm6jQF25UTqU6PbYi7SIySIZc6RfS2oZ6i8TBP4J5:TnPeU6r7SrZc6R62sL8d4
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe -
Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1756 sc.exe 1708 sc.exe 2096 sc.exe 2728 sc.exe 1764 sc.exe 2556 sc.exe 1676 sc.exe 1924 sc.exe 1952 sc.exe 1544 sc.exe 2396 sc.exe 1940 sc.exe 1132 sc.exe 1644 sc.exe 2268 sc.exe 1788 sc.exe 608 sc.exe 2908 sc.exe 2760 sc.exe 1804 sc.exe 2160 sc.exe 536 sc.exe 2892 sc.exe 3000 sc.exe 2496 sc.exe 2248 sc.exe 2176 sc.exe 284 sc.exe 1948 sc.exe 2480 sc.exe 2132 sc.exe 1592 sc.exe 1772 sc.exe 2832 sc.exe 1600 sc.exe 1980 sc.exe 1480 sc.exe 2356 sc.exe 484 sc.exe 2020 sc.exe 1104 sc.exe 1956 sc.exe 1844 sc.exe 1836 sc.exe 1772 sc.exe 2188 sc.exe 1664 sc.exe 1920 sc.exe 2836 sc.exe 2896 sc.exe 2604 sc.exe 1552 sc.exe 1364 sc.exe 2816 sc.exe 1716 sc.exe 1752 sc.exe 552 sc.exe 2296 sc.exe 1208 sc.exe 1740 sc.exe 2448 sc.exe 2828 sc.exe 2640 sc.exe 2284 sc.exe -
Kills process with taskkill 64 IoCs
pid Process 2560 taskkill.exe 352 taskkill.exe 2924 taskkill.exe 1948 taskkill.exe 448 taskkill.exe 1084 taskkill.exe 1748 taskkill.exe 2740 taskkill.exe 2252 taskkill.exe 2728 taskkill.exe 1312 taskkill.exe 2712 taskkill.exe 1956 taskkill.exe 2780 taskkill.exe 604 taskkill.exe 2824 taskkill.exe 1300 taskkill.exe 2592 taskkill.exe 2168 taskkill.exe 1272 taskkill.exe 2064 taskkill.exe 2484 taskkill.exe 1776 taskkill.exe 320 taskkill.exe 1964 taskkill.exe 2260 taskkill.exe 920 taskkill.exe 2864 taskkill.exe 2860 taskkill.exe 1960 taskkill.exe 2308 taskkill.exe 1680 taskkill.exe 1440 taskkill.exe 1660 taskkill.exe 1060 taskkill.exe 2156 taskkill.exe 2640 taskkill.exe 2476 taskkill.exe 2492 taskkill.exe 2656 taskkill.exe 2228 taskkill.exe 2024 taskkill.exe 468 taskkill.exe 2712 taskkill.exe 2868 taskkill.exe 2832 taskkill.exe 828 taskkill.exe 2280 taskkill.exe 1880 taskkill.exe 2232 taskkill.exe 1680 taskkill.exe 1620 taskkill.exe 1688 taskkill.exe 2380 taskkill.exe 2844 taskkill.exe 2860 taskkill.exe 1208 taskkill.exe 1668 taskkill.exe 1880 taskkill.exe 3060 taskkill.exe 1252 taskkill.exe 2452 taskkill.exe 2756 taskkill.exe 2928 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2712 taskkill.exe Token: SeDebugPrivilege 2640 taskkill.exe Token: SeDebugPrivilege 1836 taskkill.exe Token: SeDebugPrivilege 2656 taskkill.exe Token: SeDebugPrivilege 1440 taskkill.exe Token: SeDebugPrivilege 1964 taskkill.exe Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 1208 taskkill.exe Token: SeDebugPrivilege 2232 taskkill.exe Token: SeDebugPrivilege 1672 taskkill.exe Token: SeDebugPrivilege 2924 taskkill.exe Token: SeDebugPrivilege 1748 taskkill.exe Token: SeDebugPrivilege 2340 taskkill.exe Token: SeDebugPrivilege 1660 taskkill.exe Token: SeDebugPrivilege 2260 taskkill.exe Token: SeDebugPrivilege 920 taskkill.exe Token: SeDebugPrivilege 2740 taskkill.exe Token: SeDebugPrivilege 2476 taskkill.exe Token: SeDebugPrivilege 2492 taskkill.exe Token: SeDebugPrivilege 2712 taskkill.exe Token: SeDebugPrivilege 2520 taskkill.exe Token: SeDebugPrivilege 2756 taskkill.exe Token: SeDebugPrivilege 1860 taskkill.exe Token: SeDebugPrivilege 2780 taskkill.exe Token: SeDebugPrivilege 2928 taskkill.exe Token: SeDebugPrivilege 2380 taskkill.exe Token: SeDebugPrivilege 1060 taskkill.exe Token: SeDebugPrivilege 1592 taskkill.exe Token: SeDebugPrivilege 1516 taskkill.exe Token: SeDebugPrivilege 2860 taskkill.exe Token: SeDebugPrivilege 1316 taskkill.exe Token: SeDebugPrivilege 2844 taskkill.exe Token: SeDebugPrivilege 1300 taskkill.exe Token: SeDebugPrivilege 3060 taskkill.exe Token: SeDebugPrivilege 2868 taskkill.exe Token: SeDebugPrivilege 1960 taskkill.exe Token: SeDebugPrivilege 1252 taskkill.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 1620 taskkill.exe Token: SeDebugPrivilege 1272 taskkill.exe Token: SeDebugPrivilege 2540 taskkill.exe Token: SeDebugPrivilege 2728 taskkill.exe Token: SeDebugPrivilege 2816 taskkill.exe Token: SeDebugPrivilege 2032 taskkill.exe Token: SeDebugPrivilege 2020 taskkill.exe Token: SeDebugPrivilege 1948 taskkill.exe Token: SeDebugPrivilege 1312 taskkill.exe Token: SeDebugPrivilege 2156 taskkill.exe Token: SeDebugPrivilege 2308 taskkill.exe Token: SeDebugPrivilege 2228 taskkill.exe Token: SeDebugPrivilege 2860 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeDebugPrivilege 1672 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 448 taskkill.exe Token: SeDebugPrivilege 1880 taskkill.exe Token: SeDebugPrivilege 1668 taskkill.exe Token: SeDebugPrivilege 1680 taskkill.exe Token: SeDebugPrivilege 1792 taskkill.exe Token: SeDebugPrivilege 2560 taskkill.exe Token: SeDebugPrivilege 2832 taskkill.exe Token: SeDebugPrivilege 2484 taskkill.exe Token: SeDebugPrivilege 2592 taskkill.exe Token: SeDebugPrivilege 1776 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2624 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 29 PID 1484 wrote to memory of 2624 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 29 PID 1484 wrote to memory of 2624 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 29 PID 1484 wrote to memory of 2828 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 30 PID 1484 wrote to memory of 2828 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 30 PID 1484 wrote to memory of 2828 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 30 PID 2828 wrote to memory of 2712 2828 cmd.exe 31 PID 2828 wrote to memory of 2712 2828 cmd.exe 31 PID 2828 wrote to memory of 2712 2828 cmd.exe 31 PID 1484 wrote to memory of 2540 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 33 PID 1484 wrote to memory of 2540 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 33 PID 1484 wrote to memory of 2540 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 33 PID 2540 wrote to memory of 2640 2540 cmd.exe 34 PID 2540 wrote to memory of 2640 2540 cmd.exe 34 PID 2540 wrote to memory of 2640 2540 cmd.exe 34 PID 1484 wrote to memory of 1860 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 35 PID 1484 wrote to memory of 1860 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 35 PID 1484 wrote to memory of 1860 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 35 PID 1860 wrote to memory of 1836 1860 cmd.exe 36 PID 1860 wrote to memory of 1836 1860 cmd.exe 36 PID 1860 wrote to memory of 1836 1860 cmd.exe 36 PID 1484 wrote to memory of 2764 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 37 PID 1484 wrote to memory of 2764 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 37 PID 1484 wrote to memory of 2764 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 37 PID 2764 wrote to memory of 2656 2764 cmd.exe 38 PID 2764 wrote to memory of 2656 2764 cmd.exe 38 PID 2764 wrote to memory of 2656 2764 cmd.exe 38 PID 1484 wrote to memory of 2020 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 39 PID 1484 wrote to memory of 2020 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 39 PID 1484 wrote to memory of 2020 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 39 PID 2020 wrote to memory of 1440 2020 cmd.exe 40 PID 2020 wrote to memory of 1440 2020 cmd.exe 40 PID 2020 wrote to memory of 1440 2020 cmd.exe 40 PID 1484 wrote to memory of 1948 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 41 PID 1484 wrote to memory of 1948 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 41 PID 1484 wrote to memory of 1948 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 41 PID 1948 wrote to memory of 1964 1948 cmd.exe 42 PID 1948 wrote to memory of 1964 1948 cmd.exe 42 PID 1948 wrote to memory of 1964 1948 cmd.exe 42 PID 1484 wrote to memory of 1312 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 43 PID 1484 wrote to memory of 1312 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 43 PID 1484 wrote to memory of 1312 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 43 PID 1312 wrote to memory of 1956 1312 cmd.exe 44 PID 1312 wrote to memory of 1956 1312 cmd.exe 44 PID 1312 wrote to memory of 1956 1312 cmd.exe 44 PID 1484 wrote to memory of 1624 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 45 PID 1484 wrote to memory of 1624 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 45 PID 1484 wrote to memory of 1624 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 45 PID 1624 wrote to memory of 1208 1624 cmd.exe 46 PID 1624 wrote to memory of 1208 1624 cmd.exe 46 PID 1624 wrote to memory of 1208 1624 cmd.exe 46 PID 1484 wrote to memory of 468 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 47 PID 1484 wrote to memory of 468 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 47 PID 1484 wrote to memory of 468 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 47 PID 468 wrote to memory of 2356 468 cmd.exe 48 PID 468 wrote to memory of 2356 468 cmd.exe 48 PID 468 wrote to memory of 2356 468 cmd.exe 48 PID 1484 wrote to memory of 1060 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 49 PID 1484 wrote to memory of 1060 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 49 PID 1484 wrote to memory of 1060 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 49 PID 1060 wrote to memory of 484 1060 cmd.exe 50 PID 1060 wrote to memory of 484 1060 cmd.exe 50 PID 1060 wrote to memory of 484 1060 cmd.exe 50 PID 1484 wrote to memory of 1652 1484 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe"C:\Users\Admin\AppData\Local\Temp\WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:2624
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:2356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:1652
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:268
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:1592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:3024
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:1756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2252
-
C:\Windows\system32\sc.exesc stop wireshark3⤵PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:2316
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:2268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:2652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2856
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:1104
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:1772
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:448
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:2320
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:1524
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:940
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:832
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:1364
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:1800
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:1752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:2368
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1680
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:2892
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:2896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:2872
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵PID:1732
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1484 -s 11002⤵PID:1272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2132
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:1544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:2932
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:1708
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:1992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2904
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:844
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:1972
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:2532
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:3040
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:2772
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:1836
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:2776
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:1440
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:2020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:1936
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:1804
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:2028
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:1948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:2444
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:2396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:2360
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2156
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:2160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:2024
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:1208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:316
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:1228
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:1584
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:484
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:1596
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:2236
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:2224
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:2248
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:324
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:904
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:2924
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:1508
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:1132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:1748
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵PID:448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:668
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:1664
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:1156
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:1940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:1244
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:1764
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:1916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:1852
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:940
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:832
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:2204
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:1560
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:552
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:2892
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:2132
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:2952
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:2560
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:2096
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:2988
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:2604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:2960
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:2832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:2820
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:2480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2500
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:2556
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:1972
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:2828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:2620
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2496
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:2660
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:2772
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:2900
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:1820
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:1996
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:2444
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:2160
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:556
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1788
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:332
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:536
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:2356
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:1552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:1068
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:1644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:2392
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:1600
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2112
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:1676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:484
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:1592
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2252
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:1388
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:584
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:2856
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:1472
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:2300
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:1640
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:668
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:1244
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:2260
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:1852
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:2448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:980
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:3000
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:2864
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:1364
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2716
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:2836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:2276
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:1980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:2792
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2508
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:1812
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:1620
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:1532
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:2096
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:2256
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:844
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:2828
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:1984
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:2640
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:2540
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:2496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:2704
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:2728
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:2800
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:1860
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:2816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2656
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:2908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:2032
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:1952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:1964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2020
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:2200
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:2432
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2024
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:316
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
PID:468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:1552
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵PID:2356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:1584
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
PID:320
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:884
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵PID:1548
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:2308
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2252
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:1388
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:2224
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:2296
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:648
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:2248
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:1316
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:2176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:324
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:1104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵PID:2924
-
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:2284
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:2424
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:2304
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:2352
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
PID:1084
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:2320
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
PID:1880
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:1244
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:2344
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
PID:604
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵PID:1364
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵PID:1980
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
PID:2824
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵PID:2896
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
PID:352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵PID:1576
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
PID:1688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵PID:2932
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:2892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵PID:1620
-
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:2188
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵PID:1992
-
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:2132
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵PID:1532
-
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:2760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵PID:2904
-
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵PID:2488
-
-