Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe
Resource
win7-20240508-en
7 signatures
150 seconds
General
-
Target
WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe
-
Size
9.5MB
-
MD5
e6d512680551588927a4be527845d488
-
SHA1
1d4c4fe2f8804313e0db9b58bc58414a5117f688
-
SHA256
9fb32a17637b8291d56b2dfad58469416f146235a37a750587eb1a993063c19d
-
SHA512
f915a973ce546e7d3a3e61e658f478e8c1d9c2d93377f984efc0dede796762fd923866d62bbf67e48aaa92eafb71555e75c6762406765bfd62ba00e1d342df17
-
SSDEEP
196608:TnYm6jQF25UTqU6PbYi7SIySIZc6RfS2oZ6i8TBP4J5:TnPeU6r7SrZc6R62sL8d4
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe -
Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5076 sc.exe 860 sc.exe 1004 sc.exe 4948 sc.exe 1040 sc.exe 2772 sc.exe 4344 sc.exe -
Kills process with taskkill 12 IoCs
pid Process 4968 taskkill.exe 2256 taskkill.exe 2468 taskkill.exe 1344 taskkill.exe 4684 taskkill.exe 3952 taskkill.exe 3932 taskkill.exe 4596 taskkill.exe 2396 taskkill.exe 4020 taskkill.exe 2152 taskkill.exe 3620 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2152 taskkill.exe Token: SeDebugPrivilege 3620 taskkill.exe Token: SeDebugPrivilege 4684 taskkill.exe Token: SeDebugPrivilege 3932 taskkill.exe Token: SeDebugPrivilege 4596 taskkill.exe Token: SeDebugPrivilege 2396 taskkill.exe Token: SeDebugPrivilege 3952 taskkill.exe Token: SeDebugPrivilege 4968 taskkill.exe Token: SeDebugPrivilege 2256 taskkill.exe Token: SeDebugPrivilege 2468 taskkill.exe Token: SeDebugPrivilege 4020 taskkill.exe Token: SeDebugPrivilege 1344 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 5100 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 86 PID 1888 wrote to memory of 5100 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 86 PID 5100 wrote to memory of 2328 5100 cmd.exe 87 PID 5100 wrote to memory of 2328 5100 cmd.exe 87 PID 1888 wrote to memory of 2108 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 89 PID 1888 wrote to memory of 2108 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 89 PID 2108 wrote to memory of 2152 2108 cmd.exe 90 PID 2108 wrote to memory of 2152 2108 cmd.exe 90 PID 1888 wrote to memory of 3160 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 91 PID 1888 wrote to memory of 3160 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 91 PID 3160 wrote to memory of 3620 3160 cmd.exe 92 PID 3160 wrote to memory of 3620 3160 cmd.exe 92 PID 1888 wrote to memory of 3284 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 93 PID 1888 wrote to memory of 3284 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 93 PID 3284 wrote to memory of 4684 3284 cmd.exe 94 PID 3284 wrote to memory of 4684 3284 cmd.exe 94 PID 1888 wrote to memory of 4956 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 95 PID 1888 wrote to memory of 4956 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 95 PID 4956 wrote to memory of 3932 4956 cmd.exe 96 PID 4956 wrote to memory of 3932 4956 cmd.exe 96 PID 1888 wrote to memory of 2324 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 97 PID 1888 wrote to memory of 2324 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 97 PID 2324 wrote to memory of 4596 2324 cmd.exe 98 PID 2324 wrote to memory of 4596 2324 cmd.exe 98 PID 1888 wrote to memory of 4268 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 99 PID 1888 wrote to memory of 4268 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 99 PID 4268 wrote to memory of 2396 4268 cmd.exe 100 PID 4268 wrote to memory of 2396 4268 cmd.exe 100 PID 1888 wrote to memory of 1452 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 101 PID 1888 wrote to memory of 1452 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 101 PID 1452 wrote to memory of 3952 1452 cmd.exe 102 PID 1452 wrote to memory of 3952 1452 cmd.exe 102 PID 1888 wrote to memory of 4152 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 103 PID 1888 wrote to memory of 4152 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 103 PID 4152 wrote to memory of 4968 4152 cmd.exe 104 PID 4152 wrote to memory of 4968 4152 cmd.exe 104 PID 1888 wrote to memory of 3944 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 105 PID 1888 wrote to memory of 3944 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 105 PID 1888 wrote to memory of 2644 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 106 PID 1888 wrote to memory of 2644 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 106 PID 2644 wrote to memory of 1004 2644 cmd.exe 107 PID 2644 wrote to memory of 1004 2644 cmd.exe 107 PID 1888 wrote to memory of 2252 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 108 PID 1888 wrote to memory of 2252 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 108 PID 2252 wrote to memory of 4948 2252 cmd.exe 109 PID 2252 wrote to memory of 4948 2252 cmd.exe 109 PID 1888 wrote to memory of 1324 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 111 PID 1888 wrote to memory of 1324 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 111 PID 1324 wrote to memory of 1040 1324 cmd.exe 112 PID 1324 wrote to memory of 1040 1324 cmd.exe 112 PID 1888 wrote to memory of 668 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 113 PID 1888 wrote to memory of 668 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 113 PID 668 wrote to memory of 2772 668 cmd.exe 114 PID 668 wrote to memory of 2772 668 cmd.exe 114 PID 1888 wrote to memory of 1712 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 116 PID 1888 wrote to memory of 1712 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 116 PID 1712 wrote to memory of 4344 1712 cmd.exe 117 PID 1712 wrote to memory of 4344 1712 cmd.exe 117 PID 1888 wrote to memory of 4888 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 118 PID 1888 wrote to memory of 4888 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 118 PID 4888 wrote to memory of 5076 4888 cmd.exe 120 PID 4888 wrote to memory of 5076 4888 cmd.exe 120 PID 1888 wrote to memory of 688 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 121 PID 1888 wrote to memory of 688 1888 WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe"C:\Users\Admin\AppData\Local\Temp\WL1FIKZrIDoFw7XzP7SHK27KGML6JFbu.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\system32\SystemSettingsAdminFlows.exeSystemSettingsAdminFlows.exe SetInternetTime 13⤵PID:2328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq ida*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3944
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\system32\sc.exesc stop HTTPDebuggerPro3⤵
- Launches sc.exe
PID:1004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\sc.exesc stop HTTPDebuggerProSdk3⤵
- Launches sc.exe
PID:4948
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\system32\sc.exesc stop KProcessHacker33⤵
- Launches sc.exe
PID:1040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\system32\sc.exesc stop KProcessHacker23⤵
- Launches sc.exe
PID:2772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\sc.exesc stop KProcessHacker13⤵
- Launches sc.exe
PID:4344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\system32\sc.exesc stop wireshark3⤵
- Launches sc.exe
PID:5076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul2⤵PID:688
-
C:\Windows\system32\sc.exesc stop npf3⤵
- Launches sc.exe
PID:860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul2⤵PID:3016
-
C:\Windows\system32\SystemSettingsAdminFlows.exeSystemSettingsAdminFlows.exe SetInternetTime 13⤵PID:2608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul2⤵PID:884
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul2⤵PID:3076
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul2⤵PID:760
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul2⤵PID:2224
-
C:\Windows\system32\taskkill.exetaskkill /FI "IMAGENAME eq charles*" /IM * /F /T3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-