xworm | 0ffc383067c74a8ca5576ed940e77e6adb0ec979294b1c12746d541e51558743

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prism Release/Prism Release V1.3.exe
Size 5.1MB
Sample240617-ryaz6athrd
SHA256 af714718f7ad3bcb60321daf63f23e7f2a586903baea8014d5f27dd65d4a9413
MD5 7e1841390354f79ea0a211457dded684
SHA1 6c500478bd165f741ed469a571b94fd159aa03a0
SHA512 6c0f54c9c1e794c3e01d3725bf1c9e654254f6a9068dc287ed7b11ee7abc226307712a62d3ac034e38b993e6e19c12f8593bfbf9cab1c5df4f49123187cc4ca5
SSDEEP 98304:LpyqiI/na1r1jg/hNMNNrrpbeRB45YenyHCaCP9iKIA20Fh1SDi3GoYm:Nr/na/OGLrrpqR25FyHCaeXhFyDi3GoY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

91.92.241.69:5555

Attributes

Install_directory
%ProgramData%
install_file
Windows Runtime.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/files/0x0008000000023416-35.dat	family_xworm
behavioral4/memory/4720-42-0x00000000005A0000-0x00000000005BA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4348	powershell.exe
940	powershell.exe
1340	powershell.exe
3772	powershell.exe
4936	powershell.exe
4700	powershell.exe
940	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	dllhost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	Prism Release V1.3.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel Graphics Processor.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel Graphics Processor.exe	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
720	prism.exe
4720	dllhost.exe
2948	nexusloader.exe
4928	Windows Runtime.exe
3768	yxswer.exe
5104	svchost.exe
1464	svchost.exe
4552	Windows Runtime.exe
4904	Process not Found

Loads dropped DLL 64 IoCs

pid	Process
2948	nexusloader.exe
2948	nexusloader.exe
2948	nexusloader.exe
2948	nexusloader.exe
2948	nexusloader.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
1464	svchost.exe
1464	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Runtime = "C:\\ProgramData\\Windows Runtime.exe"	dllhost.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	ip-api.com
44	api.ipify.org
45	api.ipify.org
46	ipinfo.io
47	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
832	schtasks.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
4276	taskkill.exe
3100	taskkill.exe
3396	taskkill.exe
1696	Process not Found
736	taskkill.exe
3876	taskkill.exe
1852	taskkill.exe
1632	Process not Found
1768	Process not Found
3692	Process not Found
4136	taskkill.exe
2972	taskkill.exe
3144	taskkill.exe
4872	taskkill.exe
3032	Process not Found
2628	Process not Found
4656	taskkill.exe
1632	taskkill.exe
3972	taskkill.exe
1056	taskkill.exe
4100	taskkill.exe
912	taskkill.exe
4908	taskkill.exe
1772	taskkill.exe
2800	Process not Found
1376	taskkill.exe
3076	taskkill.exe
4588	taskkill.exe
1068	taskkill.exe
4484	taskkill.exe
3128	taskkill.exe
2984	taskkill.exe
3428	taskkill.exe
1172	taskkill.exe
1176	Process not Found
2508	Process not Found
2488	taskkill.exe
2328	taskkill.exe
400	taskkill.exe
2052	taskkill.exe
4832	taskkill.exe
3940	taskkill.exe
3116	taskkill.exe
2084	Process not Found
2824	Process not Found
1452	Process not Found
4164	taskkill.exe
3488	taskkill.exe
2976	taskkill.exe
1812	taskkill.exe
4656	taskkill.exe
4372	taskkill.exe
1396	Process not Found
832	taskkill.exe
1880	taskkill.exe
1828	taskkill.exe
1240	taskkill.exe
1704	taskkill.exe
4992	Process not Found
1376	Process not Found
4404	taskkill.exe
4476	taskkill.exe
3616	taskkill.exe
4328	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4720	dllhost.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4348	powershell.exe
4348	powershell.exe
1340	powershell.exe
1340	powershell.exe
3772	powershell.exe
3772	powershell.exe
4936	powershell.exe
4936	powershell.exe
4700	powershell.exe
4700	powershell.exe
4720	dllhost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
5104	svchost.exe
940	powershell.exe
940	powershell.exe
5104	svchost.exe
5104	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	dllhost.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeDebugPrivilege	4720	dllhost.exe
Token: SeDebugPrivilege	4928	Windows Runtime.exe
Token: SeDebugPrivilege	5104	svchost.exe
Token: SeDebugPrivilege	1464	svchost.exe
Token: SeDebugPrivilege	3940	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	4376	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	4256	taskkill.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	1700	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	4764	taskkill.exe
Token: SeDebugPrivilege	5064	taskkill.exe
Token: SeDebugPrivilege	3556	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	3220	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	4164	taskkill.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: SeDebugPrivilege	736	taskkill.exe
Token: SeDebugPrivilege	1028	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	1552	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	4328	taskkill.exe
Token: SeDebugPrivilege	1660	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	3948	taskkill.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	2084	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	4020	taskkill.exe
Token: SeDebugPrivilege	3136	taskkill.exe
Token: SeDebugPrivilege	4276	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	4656	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	1592	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4720	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4348	4372	Prism Release V1.3.exe	81
PID 4372 wrote to memory of 4348	4372	Prism Release V1.3.exe	81
PID 4372 wrote to memory of 4348	4372	Prism Release V1.3.exe	81
PID 4372 wrote to memory of 720	4372	Prism Release V1.3.exe	83
PID 4372 wrote to memory of 720	4372	Prism Release V1.3.exe	83
PID 4372 wrote to memory of 4720	4372	Prism Release V1.3.exe	84
PID 4372 wrote to memory of 4720	4372	Prism Release V1.3.exe	84
PID 720 wrote to memory of 2948	720	prism.exe	87
PID 720 wrote to memory of 2948	720	prism.exe	87
PID 4720 wrote to memory of 1340	4720	dllhost.exe	90
PID 4720 wrote to memory of 1340	4720	dllhost.exe	90
PID 4720 wrote to memory of 3772	4720	dllhost.exe	92
PID 4720 wrote to memory of 3772	4720	dllhost.exe	92
PID 4720 wrote to memory of 4936	4720	dllhost.exe	94
PID 4720 wrote to memory of 4936	4720	dllhost.exe	94
PID 4720 wrote to memory of 4700	4720	dllhost.exe	96
PID 4720 wrote to memory of 4700	4720	dllhost.exe	96
PID 4720 wrote to memory of 832	4720	dllhost.exe	98
PID 4720 wrote to memory of 832	4720	dllhost.exe	98
PID 4720 wrote to memory of 3768	4720	dllhost.exe	103
PID 4720 wrote to memory of 3768	4720	dllhost.exe	103
PID 3768 wrote to memory of 5104	3768	yxswer.exe	104
PID 3768 wrote to memory of 5104	3768	yxswer.exe	104
PID 5104 wrote to memory of 2656	5104	svchost.exe	105
PID 5104 wrote to memory of 2656	5104	svchost.exe	105
PID 5104 wrote to memory of 1464	5104	svchost.exe	107
PID 5104 wrote to memory of 1464	5104	svchost.exe	107
PID 1464 wrote to memory of 1960	1464	svchost.exe	108
PID 1464 wrote to memory of 1960	1464	svchost.exe	108
PID 1464 wrote to memory of 2924	1464	svchost.exe	110
PID 1464 wrote to memory of 2924	1464	svchost.exe	110
PID 2924 wrote to memory of 3940	2924	cmd.exe	112
PID 2924 wrote to memory of 3940	2924	cmd.exe	112
PID 1464 wrote to memory of 3100	1464	svchost.exe	113
PID 1464 wrote to memory of 3100	1464	svchost.exe	113
PID 3100 wrote to memory of 1376	3100	cmd.exe	115
PID 3100 wrote to memory of 1376	3100	cmd.exe	115
PID 1464 wrote to memory of 4236	1464	svchost.exe	116
PID 1464 wrote to memory of 4236	1464	svchost.exe	116
PID 4236 wrote to memory of 4376	4236	cmd.exe	118
PID 4236 wrote to memory of 4376	4236	cmd.exe	118
PID 1464 wrote to memory of 2708	1464	svchost.exe	119
PID 1464 wrote to memory of 2708	1464	svchost.exe	119
PID 2708 wrote to memory of 4644	2708	cmd.exe	121
PID 2708 wrote to memory of 4644	2708	cmd.exe	121
PID 1464 wrote to memory of 1500	1464	svchost.exe	122
PID 1464 wrote to memory of 1500	1464	svchost.exe	122
PID 1500 wrote to memory of 4656	1500	cmd.exe	124
PID 1500 wrote to memory of 4656	1500	cmd.exe	124
PID 1464 wrote to memory of 2476	1464	svchost.exe	125
PID 1464 wrote to memory of 2476	1464	svchost.exe	125
PID 5104 wrote to memory of 940	5104	svchost.exe	127
PID 5104 wrote to memory of 940	5104	svchost.exe	127
PID 2476 wrote to memory of 4256	2476	cmd.exe	129
PID 2476 wrote to memory of 4256	2476	cmd.exe	129
PID 1464 wrote to memory of 2248	1464	svchost.exe	130
PID 1464 wrote to memory of 2248	1464	svchost.exe	130
PID 2248 wrote to memory of 1700	2248	cmd.exe	132
PID 2248 wrote to memory of 1700	2248	cmd.exe	132
PID 1464 wrote to memory of 5092	1464	svchost.exe	133
PID 1464 wrote to memory of 5092	1464	svchost.exe	133
PID 5092 wrote to memory of 5080	5092	cmd.exe	135
PID 5092 wrote to memory of 5080	5092	cmd.exe	135
PID 1464 wrote to memory of 4092	1464	svchost.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Prism Release\Prism Release V1.3.exe
"C:\Users\Admin\AppData\Local\Temp\Prism Release\Prism Release V1.3.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAeABpACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAG4AYQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcALgBnAGcALwBnAGUAdABwAHIAaQBzAG0AIAAtACAAUgB1AG4AIABBAHMAIABBAGQAbQBpAG4AIABJAGYAIABJAG4AagBlAGMAdABpAG8AbgAgAEYAYQBpAGwAcwAnACwAJwAnACwAJwBPAEsAJwAsACcASQBuAGYAbwByAG0AYQB0AGkAbwBuACcAKQA8ACMAdQBzAG4AIwA+AA=="
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\prism.exe
  "C:\Users\Admin\AppData\Local\Temp\prism.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\nexusloader.exe
    "C:\Users\Admin\AppData\Local\Temp\prism.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2948
- C:\Users\Admin\dllhost.exe
  "C:\Users\Admin\dllhost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"
    3⤵
    - Creates scheduled task(s)
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\yxswer.exe
    "C:\Users\Admin\AppData\Local\Temp\yxswer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\onefile_3768_133631086124939346\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\yxswer.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\onefile_3768_133631086124939346\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\onefile_3768_133631086124939346\svchost.exe" "--multiprocessing-fork" "parent_pid=5104" "pipe_handle=280"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:1960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4376
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4644
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5064
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3948
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1444
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2336
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3080
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2184
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3348
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:3616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2084
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:736
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4912
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1772
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1328
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3264
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3144
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4212
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:64
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:2656
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4312
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:232
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:5084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4964
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2188
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2532
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Kills process with taskkill
        
        PID:2972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4280
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Kills process with taskkill
        
        PID:4136
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4576
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Kills process with taskkill
        
        PID:4832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Kills process with taskkill
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3124
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:5084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Kills process with taskkill
        
        PID:3100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3488
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1052
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Kills process with taskkill
        
        PID:3396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4212
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1496
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:4576
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4700
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4904
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2632
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2580
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2304
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:1832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:1044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:992
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:2096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4136
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        Kills process with taskkill
        
        PID:3876
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3112
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:3776
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:4644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3172
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1756
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3856
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:740
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2956
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1040
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:716
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4908
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3108
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3928
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Kills process with taskkill
        
        PID:1852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3020
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2724
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1320
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        Kills process with taskkill
        
        PID:3488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3336
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4656
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:3520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        
        PID:3076
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2680
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3540
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:1424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3532
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4328
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1004
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1864
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4360
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4180
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4448
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1944
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3672
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5088
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:736
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1800
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4348
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:3976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1552
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4564
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3260
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2724
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4904
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:1880
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1320
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1700
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3076
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:5080
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:3140
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2328
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:5064
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3144
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3616
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:1864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4396
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1472
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3936
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        
        PID:2976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2456
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2812
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:2432
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2920
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1468
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2572
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3764
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4912
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3260
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4904
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4660
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4644
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3968
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:860
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2424
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Kills process with taskkill
        
        PID:1240
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1480
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3384
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5064
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3860
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Kills process with taskkill
        
        PID:4588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:5068
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:2600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4100
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1944
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4264
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2984
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:884
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2804
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3840
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2104
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4652
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2628
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1632
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3692
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4700
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4260
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4640
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2092
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:3028
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2532
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:544
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:860
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1240
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:740
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3552
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:112
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4544
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2096
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Kills process with taskkill
        
        PID:4872
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Kills process with taskkill
        
        PID:4100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2272
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4620
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:184
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2640
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2164
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:3428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:440
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4548
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:452
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2932
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:2652
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:3828
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3044
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1644
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1960
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2580
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3724
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3540
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4192
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:2364
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4500
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:860
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1820
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1240
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2424
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4476
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3740
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3380
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:5108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4180
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:640
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3440
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4392
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:2656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:528
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:940
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1800
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4652
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3876
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:1476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Kills process with taskkill
        
        PID:1812
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2124
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4912
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:808
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3124
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3776
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4700
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3828
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:3488
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4388
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:684
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4252
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2188
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Kills process with taskkill
        
        PID:1068
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3144
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1480
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1864
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2788
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1704
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4124
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Kills process with taskkill
        
        PID:912
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:836
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:1928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:1580
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4264
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4396
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:2492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3668
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4392
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1448
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4312
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:996
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3960
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1444
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1828
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:2912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3632
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2296
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2072
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4600
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3032
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:3172
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2184
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3336
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        Kills process with taskkill
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:980
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4252
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1952
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4352
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4536
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3144
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3552
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:2964
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2552
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:3384
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3380
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1056
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:5048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4100
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4828
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2160
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3668
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:5036
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1456
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4936
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1468
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2460
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4564
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4768
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:2912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2296
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3776
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3028
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3260
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2884
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2248
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3076
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1752
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:3856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:1236
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2328
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3556
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Kills process with taskkill
        
        PID:4484
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4992
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4292
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3432
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1524
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:912
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3384
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1928
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2344
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2180
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:716
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3940
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1852
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1800
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Kills process with taskkill
        
        PID:4372
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:5052
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4596
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2924
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3080
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3152
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1812
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3916
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:1176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1880
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2404
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1572
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1356
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:3076
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4252
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2188
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:4376
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4520
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3464
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3932
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3144
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3528
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3948
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1704
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3352
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:5068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1928
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3484
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4404
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3052
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3516
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:5016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1800
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        Kills process with taskkill
        
        PID:3972
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2104
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4596
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2628
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:708
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3916
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3128
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:2336
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:2652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4856
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2132
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:3172
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4236
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4976
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:980
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1328
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1592
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4252
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3588
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:768
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:400
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:1016
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1864
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2956
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3276
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1040
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4896
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:5068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        Kills process with taskkill
        
        PID:4908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3108
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:1768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:1944
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:4576
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:856
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:184
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2812
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2164
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:3692
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:3116
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:3152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        Kills process with taskkill
        
        PID:3128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4128
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1880
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2404
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:2132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:1320
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:4656
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:3520
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4976
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:748
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:1328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:1952
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:4252
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4376
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4460
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2972
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4500
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        Kills process with taskkill
        
        PID:400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4060
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2956
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4668
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2080
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Kills process with taskkill
        
        PID:1704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4572
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1524
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4788
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:5048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:3672
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2496
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4620
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3896
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4020
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:2160
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:5016
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        Kills process with taskkill
        
        PID:3940
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:2920
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3428
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1104
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:4936
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:232
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1828
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2924
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2916
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        
        PID:3116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:372
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:1176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:4856
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:3396
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:1996
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4904
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Kills process with taskkill
        
        PID:1772
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2632
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2248
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:3076
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:3096
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:544
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:2580
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1820
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:228
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:1660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:1044
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4500
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4180
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4960
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:912
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1804
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:1040
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:5024
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4908
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:5068
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2496
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        
        PID:2984
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3896
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:3256
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3516
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:1968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:4040
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1852
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4652
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        Kills process with taskkill
        
        PID:3428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:5084
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2488
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:2508
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:2852
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:5116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:1812
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:2336
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:3120
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:808
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3764
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:2884
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:3828
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:4056
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4284
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:1424
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2532
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:3096
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1384
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:2452
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:4352
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:4436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:4460
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        Kills process with taskkill
        
        PID:4328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:4536
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:3932
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:4124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:2964
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:112
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:4808
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:2412
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:1540
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:4100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:4832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:736
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM wireshark.exe"
        6⤵
        
        PID:5048
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM wireshark.exe
        7⤵
        
        PID:1556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tshark.exe"
        6⤵
        
        PID:2492
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tshark.exe
        7⤵
        
        PID:4392
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM tcpdump.exe"
        6⤵
        
        PID:2856
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM tcpdump.exe
        7⤵
        
        PID:1072
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM ettercap.exe"
        6⤵
        
        PID:184
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM ettercap.exe
        7⤵
        
        PID:968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM dumpcap.exe"
        6⤵
        
        PID:832
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM dumpcap.exe
        7⤵
        
        PID:1248
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM windump.exe"
        6⤵
        
        PID:3204
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM windump.exe
        7⤵
        
        PID:3100
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM fiddler.exe"
        6⤵
        
        PID:2160
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM fiddler.exe
        7⤵
        
        PID:2128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM httpdebuggerui.exe"
        6⤵
        
        PID:1476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM httpdebuggerui.exe
        7⤵
        
        PID:4068
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\\\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:3184
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:4620
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:2272
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:2804
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:3876
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:2924
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:4284
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:3764
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:3968
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:3588
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3264
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:1044
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:4992
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:3484
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:4620
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:4312
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:4828
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3136
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:3776
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:1376
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:1796
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:1176
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:3172
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:4852
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:1480
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        
        PID:4808
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:1804
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        
        PID:4472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:4360
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        Kills process with taskkill
        
        PID:1056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:4680
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        
        PID:2728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:2512
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        
        PID:4020
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:5052
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3136
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        
        PID:1444
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:2164
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        
        PID:2052
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:4644
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1376
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        
        PID:2128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:4260
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        Kills process with taskkill
        
        PID:1880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:740
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        
        PID:1572
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:468
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3140
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        
        PID:228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:640
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        
        PID:992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:2096
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        
        PID:1864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:716
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        
        PID:3860
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:2080
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        
        PID:4688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:1104
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        
        PID:5088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:3772
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        
        PID:884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:4564
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        
        PID:3428
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:3260
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        
        PID:2128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:684
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        
        PID:5116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:2632
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        
        PID:2424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:4556
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        
        PID:768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:4488
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        Kills process with taskkill
        
        PID:4476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:4960
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        
        PID:5100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:4924
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Kills process with taskkill
        
        PID:3616
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:4448
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3024
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        
        PID:4688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:4832
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        
        PID:2076
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:2456
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2512
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        
        PID:4892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:3876
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1456
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        
        PID:1960
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:3776
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        
        PID:4340
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:4660
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        
        PID:2124
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:1700
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        Kills process with taskkill
        
        PID:1172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:1424
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        
        PID:2476
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:4852
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:1016
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        
        PID:920
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:1660
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:640
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        Kills process with taskkill
        
        PID:3144
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:2040
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        
        PID:3380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:1580
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4472
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        
        PID:1688
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:3104
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4404
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        
        PID:1768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:736
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        Kills process with taskkill
        
        PID:832
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:3772
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        
        PID:3420
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:2588
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        Kills process with taskkill
        
        PID:1632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        5⤵
        
        PID:4284
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        
        PID:1288
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        5⤵
        
        PID:2072
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4236
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        
        PID:1752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM firefox.exe"
        5⤵
        
        PID:960
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2380
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM firefox.exe
        6⤵
        
        PID:2304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe"
        5⤵
        
        PID:1952
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM opera.exe
        6⤵
        Kills process with taskkill
        
        PID:2328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM yandex.exe"
        5⤵
        
        PID:4476
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM yandex.exe
        6⤵
        
        PID:4536
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM iexplore.exe"
        5⤵
        
        PID:1164
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM iexplore.exe
        6⤵
        
        PID:3380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe"
        5⤵
        
        PID:2412
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM brave.exe
        6⤵
        
        PID:4896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM vivaldi.exe"
        5⤵
        
        PID:4620
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM vivaldi.exe
        6⤵
        
        PID:3672
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM Telegram.exe"
        5⤵
        
        PID:4372
      - C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM Telegram.exe
        6⤵
        
        PID:4424
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        5⤵
        
        PID:5100
      - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        6⤵
        
        PID:3828

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e
MD5 3072fa0040b347c3941144486bf30c6f
SHA1 e6dc84a5bd882198583653592f17af1bf8cbfc68
SHA512 62df0eed621fe8ec340887a03d26b125429025c14ddcdfef82cb78ce1c9c6110c1d51ff0e423754d7966b6251363bf92833970eaf67707f8dd62e1549a79536c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 adf65afaf1c83572f05a99bf2ede8eb7be1aab0717d5254f501d5e09ba6f587b
MD5 01fff31a70e26012f37789b179059e32
SHA1 555b6f05cce7daf46920df1c01eb5c55dc62c9e6
SHA512 ac310c9bc5c1effc45e1e425972b09d1f961af216b50e1a504caa046b7f1a5f3179760e0b29591d83756ecb686d17a24770cf06fcea57e6f287ca5bbf6b6971b
MD5 SHA1 SHA512

Submit Download

tcl86t.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tcl86t.dll
Size 1.8MB
SHA256 224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9
MD5 ad03d1e9f0121330694415f901af8f49
SHA1 ad8d3eee5274fef8bb300e2d1f4a11e27d3940df
SHA512 19b85c010c98fa75eacfd0b86f9c90a2dbf6f07a2b3ff5b4120108f3c26711512edf2b875a782497bdb3d28359325ad95c17951621c4b9c1fd692fde26b77c33
SSDEEP 24576:Lldauo6HQOZaWxCAnNDyY1vFsrOlwtJ6i/eFrrklM8Rc50mWszkwjLYfMiHrrTeC:Lld9QVyFrcM8RcxkwfGMiLrTzrSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_iq53gg3n.lbn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iq53gg3n.lbn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

_tkinter.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\_tkinter.pyd
Size 60KB
SHA256 336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190
MD5 0f1aa5b9a82b75b607b4ead6bb6b8be6
SHA1 5d58fd899018a106d55433ea4fcb22faf96b4b3d
SHA512 b32ea7d3ed9ae3079728c7f92e043dd0614a4da1dbf40ae3651043d35058252187c3c0ad458f4ca79b8b006575fac17246fb33329f7b908138f5de3c4e9b4e52
SSDEEP 768:e9k8DRvbV/VKfBvrUx/l93WDtbBZeaWDyms5fTabInhkz0/AAZIAYSADG4yI8h:e1RvtV+BcAeaas5fuUnheurZIAYSMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

nexusloader.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\nexusloader.exe
Size 3.5MB
SHA256 53a04c25d2943e2b2f0f5cab119bca53be2be6ca96346a4992de0ca929070443
MD5 d49ad3045643e283f713eec00504f108
SHA1 67b6af86414d24d2f8d5630fdc91d67ea149e619
SHA512 e2aa8aed19e29993f9d3fef60ebeb84429df70031c4a14031aa9df4e5b3b555f815b450fbf1ecf6263cba96f86aea1bf7f21af4de18f2033646d5143f7ec1d0d
SSDEEP 98304:+zF76mCmRczn1uerwLofxbGwERrKtf9w:QF7QMcz
MD5 SHA1 SHA512 SSDEEP

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgcat-1.6.1.tm

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl8\8.5\msgcat-1.6.1.tm
Size 33KB
SHA256 4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55
MD5 db52847c625ea3290f81238595a915cd
SHA1 45a4ed9b74965e399430290bcdcd64aca5d29159
SHA512 5a8fb4ada7b2efbf1cadd10dbe4dc7ea7acd101cb8fd0b80dad42be3ed8804fc8695c53e6aeec088c2d4c3ee01af97d148b836289da6e4f9ee14432b923c7e40
SSDEEP 768:joWBAxonz0L7KILBk0U8Vl9NFljRFpGA1TrPiBDxDFP8sCNl:MWBAxgzY7KIL7j1NFl1Fp11/PiBVBksU
MD5 SHA1 SHA512 SSDEEP

Submit Download

auto.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\auto.tcl
Size 20KB
SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
MD5 5e9b3e874f8fbeaadef3a004a1b291b5
SHA1 b356286005efb4a3a46a1fdd53e4fcdc406569d0
SHA512 482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790
SSDEEP 384:vyPcB5RJtAZ7SP9nYP9I5HU3mOuWzXBEWKYHEN+7yBtYSbI0QD+lM:AcB5RJtAFSPBYPN3mOuiVHEN+78YSbqT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cp1252.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\encoding\cp1252.enc
Size 1KB
SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
MD5 5900f51fd8b5ff75e65594eb7dd50533
SHA1 2e21300e0bc8a847d0423671b08d3c65761ee172
SHA512 ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
MD5 SHA1 SHA512

Submit Download

symbol.enc

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\encoding\symbol.enc
Size 1KB
SHA256 73fd2b5e14309d8c036d334f137b9edf1f7b32dbd45491cf93184818582d0671
MD5 1b612907f31c11858983af8c009976d6
SHA1 f0c014b6d67fc0dc1d1bbc5f052f0c8b1c63d8bf
SHA512 82d4a8f9c63f50e5d77dad979d3a59729cd2a504e7159ae3a908b7d66dc02090dabd79b6a6dc7b998c32c383f804aacabc564a5617085e02204adf0b13b13e5b
MD5 SHA1 SHA512

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\http1.0\pkgIndex.tcl
Size 735B
SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
MD5 10ec7cd64ca949099c818646b6fae31c
SHA1 6001a58a0701dff225e2510a4aaee6489a537657
SHA512 34a0acb689e430ed2903d8a903d531a3d734cb37733ef13c5d243cb9f59c020a3856aad98726e10ad7f4d67619a3af1018f6c3e53a6e073e39bd31d088efd4af
MD5 SHA1 SHA512

Submit Download

init.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\init.tcl
Size 23KB
SHA256 61c55633fa048deb120422daed84224f2bb12c7c94958ca6f679b219cf2fa939
MD5 e10e428598b2d5f2054cfae4a7029709
SHA1 f8e7490e977c3c675e76297638238e08c1a5e72e
SHA512 88ef7628af5b784229dda6772c6ddd77905238a1648d4290b496eafeec013107437218e4834b7198aeb098bc854dcb9f18083c76dd5bf3ce9cedf3d5c9e4faae
SSDEEP 384:O8Oh2gWD8Ud4zaJqacMQsRNLKx32LgWMOFaBBf6/9IrO1zWq8oXbjdEfdQxAp12y:wOD8Ud4WJqJfcMOFt/9IrOBWq8oXwQxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\opt0.4\pkgIndex.tcl
Size 607B
SHA256 eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718
MD5 92ff1e42cfc5fecce95068fc38d995b3
SHA1 b2e71842f14d5422a9093115d52f19bcca1bf881
SHA512 608d436395d055c5449a53208f3869b8793df267b8476ad31bcdd9659a222797814832720c495d938e34bf7d253ffc3f01a73cc0399c0dfb9c85d2789c7f11c0
MD5 SHA1 SHA512

Submit Download

package.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\package.tcl
Size 22KB
SHA256 47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad
MD5 55e2db5dcf8d49f8cd5b7d64fea640c7
SHA1 8fdc28822b0cc08fa3569a14a8c96edca03bfbbd
SHA512 824c210106de7eae57a480e3f6e3a5c8fb8ac4bbf0a0a386d576d3eb2a3ac849bdfe638428184056da9e81767e2b63eff8e18068a1cf5149c9f8a018f817d3e5
SSDEEP 384:I72oQXm9jcLyBLWueSzvAXMiow90l3NhETrh4NLTluYhoNL3ZAqYi:I72oQXmgyBCqvAcFw2dhOrh4NZVhoN3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

tclIndex

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\tclIndex
Size 5KB
SHA256 962c60eb7e050061462ff72cec9741a7f18307af4aaa68d7665174f904842d13
MD5 996f74f323ea95c03670734814b7887f
SHA1 49f4b9be5ab77e6ccab8091f315d424d7ac183f3
SHA512 c4694260c733dc534dc1a70791fa29b725efd078a6846434883362f06f7bf080ca07478208b1909630e1b55fbdccf14484b78b0a5b8c6dad90f190c8c9d88a56
SSDEEP 96:esataNULULUVUhU5U1UIUZUJeUpgURUFD15Q0AkU6PkrBkGUjZKspDzmK5SMFTug:eNtEACkiwM3g4ePOiD15Q0AkU6PkrBkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

tm.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tcl\tm.tcl
Size 11KB
SHA256 6c02298d56e3c4c6b197afc79ec3ce1fc37ae176dc35f5d7ac48246f05f91669
MD5 52db1cd97ceab81675e86fa0264ea539
SHA1 b31693b5408a847f97ee8004fed48e5891df6e65
SHA512 5032b0a79d0cd5a342af2f9edf8b88b7214e9aa61ba524a42c5be2286741e18fa380ad2d40dda9a0257afceed2ef6e48624013e854f37b5e41cb88a831ad04c9
SSDEEP 192:CnjVD6gOGFpvXKPrzYkWo55z3ovPvKvaWZPZ9W6TV9ujpZwiUK3mQ4ouPltqQvu9:CGQvX+XYkn59YvPSvDJTV91/4RuPltBC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tk86t.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk86t.dll
Size 1.5MB
SHA256 bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77
MD5 e3c7ed5f9d601970921523be5e6fce2c
SHA1 a7ee921e126c3c1ae8d0e274a896a33552a4bd40
SHA512 bfa76b6d754259eabc39d701d359dd96f7a4491e63b17826a05a14f8fdf87656e8fc541a40e477e4fef8d0601320dd163199520e66d9ee8b5d6bb5cd9a275901
SSDEEP 24576:s0Ul9NGSzfPBTBi7OU987qBkS0Ahl+FUduBGdiuazMsR+tCJuLxTQVgkBcdi8yXb:sLrrXi7f87wkS0Ahl+FUduBGdiFwo4Q5
MD5 SHA1 SHA512 SSDEEP

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\button.tcl
Size 20KB
SHA256 2f013b643d62f08ddaaa1dea39ff80d6607569c9e1acc19406377b64d75ccf53
MD5 cf6e5b2eb7681567c119040939dd6e2c
SHA1 3e0b905428c293f21074145fe43281f22e699eb4
SHA512 be03edea59be01d2b8de72b6ebe9dceb13d16c522bb5c042cdae83c84eafc6ac7b3650bf924f5f84f4f126634f9d17d74d087316d289f237129921a89aa4e0c8
SSDEEP 384:8zVtoY3wFnq+j4SpEdPmVmZ6/IVKuzmSaox2ESo+VtocUP5wFnq+j4SpEdPmV8Zd:coahPSFMmfoz4oFXhPovzmToQBy0zm2j
MD5 SHA1 SHA512 SSDEEP

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\entry.tcl
Size 17KB
SHA256 dd351da6288cf7e9f367fd97c97cb476193ff7461b25e31667e85fe720edea04
MD5 1d9ff9bb7fedb472910776361510c610
SHA1 c190dd07bcc55741b9bdfc210f82df7b7c2fac81
SHA512 85d25622f4e0c9517d8caa454ec4e81c8cbbec25e418f5a2d885d5561999cfb3c3026aac8bf1ca6f9b40993802fda86d60ff8fd2e30a77d56f1c1914af695f03
SSDEEP 384:P1eFkH2fRdOnOeQod3tCAERebMIDlXVQgXwVviK:PMFDqUy8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\icons.tcl
Size 10KB
SHA256 a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161
MD5 2652aad862e8fe06a4eedfb521e42b75
SHA1 ed22459ad3d192ab05a01a25af07247b89dc6440
SHA512 6ecfbb8d136444a5c0dbbce2d8a4206f1558bdd95f111d3587b095904769ac10782a9ea125d85033ad6532edf3190e86e255ac0c0c81dc314e02d95cca86b596
SSDEEP 192:TJjPyYK20kt4zHIXM2MxGwwOw0ac5lCssUOixDgzAjTXBHVXPZmEhr:pO2gz6MioacR2iBgzsFHX5r
MD5 SHA1 SHA512 SSDEEP

Submit Download

listbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\listbox.tcl
Size 14KB
SHA256 b92526a55409c67473740551ca128498824d25406e3cc9bb0544e8296d3c5de4
MD5 b3b6a3bd19ddde4a97ea7cf95d7a8322
SHA1 2f11d97c091de9202f238778c89f13a94a10d3be
SHA512 f2bc1fbbd20132725d283b9fab20c3e38ed185a62297e1418572c03fa90b3f813b878be281bb4bdfa1c813b7ee7eff11cbb2f89b5411b1707d90b0e5fd746fb3
SSDEEP 384:ZBjtAc4YusFvbaK6UFchqHjNw8wSdy+1a22YDE/q:ZFa5UBjW8RQcf
MD5 SHA1 SHA512 SSDEEP

Submit Download

menu.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\menu.tcl
Size 37KB
SHA256 588727079af7ecc44755efe33ebb7414ad2ee68390fc249ce073d38e03c78a4e
MD5 12ec5260eb7435c7170002e011fe8f17
SHA1 e88f5423a7133784a1a2d097c4e602e5de564034
SHA512 5848e5a642f0cfba8b456a6dcef711737229e5f59beb7981a52440a47f5ba9ec85374be8e8b1ccdd952ac71164da04ff88ef07204fd62509952db2cdb6503700
SSDEEP 768:0K5IzCpFl9tVbQDBTofDMpSCeihpzuxdyQYEuH9DInS3Z11:0K5i8PD7WuxdRYxH7JX
MD5 SHA1 SHA512 SSDEEP

Submit Download

panedwindow.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\panedwindow.tcl
Size 5KB
SHA256 4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29
MD5 2da0a23cc9d6fd970fe00915ea39d8a2
SHA1 dfe3dc663c19e9a50526a513043d2393869d8f90
SHA512 b458f3d391df9522d4e7eae8640af308b4209ce0d64fd490bfc0177fde970192295c1ea7229ce36d14fc3e582c7649460b8b7b0214e0ff5629b2b430a99307d4
SSDEEP 96:PmpWHrga3awUrH6kdX3pBz6tkm71cHXYV23EmkiYlgfY8:+pWHrP36r6kJ3pBetkm6HXVUmPYlgfY8
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkgIndex.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\pkgIndex.tcl
Size 372B
SHA256 e0bac49b9a3f0e50be89f692273cea7b7462bfc3e054f323261ef99b708c70a3
MD5 d942ff6f65bba8eb6d264db7d876a488
SHA1 74d6ca77e6092d79f37e7a1dcd7cced2e89d89cb
SHA512 3ac7d992300252109606074aefb693a31cd5cceffb6d7b851a2c8895a0d5e165a139b7038657306128af39c44785b7b4da35b8e1aeb4c30f3f7e7cfcfb789c4c
MD5 SHA1 SHA512

Submit Download

scale.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\scale.tcl
Size 7KB
SHA256 58c662dd3d2c653786b05aa2c88831f4e971b9105e4869d866fb6186e83ed365
MD5 1ce32cdaeb04c75bfceea5fb94b8a9f0
SHA1 cc7614c9eade999963ee78b422157b7b0739894c
SHA512 1ee5a187615ae32f17936931b30fea9551f9e3022c1f45a2bca81624404f4e68022fcf0b03fbd61820ec6958983a8f2fbfc3ad2ec158433f8e8de9b8fcf48476
SSDEEP 192:q1xTLI9LUAp8cZIQ+Umuy9vYE2dLTaQfiwHZeABypyTtB:HUN1Umn2dKuHIpCB
MD5 SHA1 SHA512 SSDEEP

Submit Download

scrlbar.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\scrlbar.tcl
Size 12KB
SHA256 189e7ee4b67861001c714a55880db34acf7d626a816e18b04b232af9e6e33e81
MD5 b44265f793563ad2ad66865dec63b2c2
SHA1 23e6f7095066ed3b65998324021d665d810e6a93
SHA512 3911b13f42091620d8d96ed0cc950792175f88399912092161e1a71f564c7e72b6d448d3b761b6b6b73400ccc8fabd94cb3bfcc8cb3ad8ebdb590c3ffc623dfb
SSDEEP 192:AfVS+eVmN0KQ0v0QIIVjvrpQQtfJMZqSwiXEfY4yhIa7yLIVNpIgdWmD3T1gFpN:MNDQw7IIVHGOfmkSwORVqaGcV4q7kpN
MD5 SHA1 SHA512 SSDEEP

Submit Download

spinbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\spinbox.tcl
Size 15KB
SHA256 5d6e939b44f630a29c4fcb1e2503690c453118607ff301bef3c07fa980d5075a
MD5 9971530f110ac2fb7d7ec91789ea2364
SHA1 ab553213c092ef077524ed56fc37da29404c79a7
SHA512 81b4cec39b03fbeca59781aa54960f0a10a09733634f401d5553e1aaa3ebf12a110c9d555946fcdd70a9cc897514663840745241ad741dc440bb081a12dcf411
SSDEEP 192:aR1yvxxVRQRrclOniQ14Yvg5bbVFMio1UF9w9P75uaMY+c6RhO1ON6Ql4qRiZ0NO:MyF5XVF61iwZ75/YRhO464z8wdEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

text.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\text.tcl
Size 32KB
SHA256 f26ed909a962d02bc03585a6c756f4fe992c311c7f53648137e427747120b441
MD5 33230f852aac8a5368aeba1834dcec77
SHA1 beba97c48a110f4a9fe86f60e5fd4ca6ac55e964
SHA512 caac54334c4eb439c18f03eeb5de83aa6bbd6bb07b760a40c60f2d34f5ee1fdd542f83ad427059863f96b0a8f2cb96658171a7cd0c0c2c49e002bd02e6d418f6
SSDEEP 384:Th9XGSuWsNGbWBFFRzGagUNKEFx8wredkG/gVVFaO/2bembFWaHnla98ffRiqiPp:T8zNGuF6uNdyO4OYa98ffRUAlde
MD5 SHA1 SHA512 SSDEEP

Submit Download

tk.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\tk.tcl
Size 23KB
SHA256 3e998b41ab23677db31902e1e876e644b279b2e6d8896443f6c434352801cdd1
MD5 25094462d2ea6b43133275bf4db31a60
SHA1 6bb76294e8fdf4d40027c9d1b994f1ab0014b81b
SHA512 8bdae921f367b864ea7f36c9a549ee870d4e4e3c6e942d70722a84ae6b23ff00a33638d8ca8f3b9b8fe084875ba7c8976975849f4dc47cdb5671df47af68cfab
SSDEEP 384:dWAlIQ7ylH462gngqeObubqLwvoGah0QSA4jLGn3WB0MCdPAWBL+g190K5TzMSWa:dWOIQulHokh0QzMemB0MCBL+g1bEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

altTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\altTheme.tcl
Size 3KB
SHA256 92b8be9d8934850b6d240b970603b0ad7c6dd4a45134545694fb52966d742861
MD5 ae1b9c4dc2de8e899749fb4e1fcb4df6
SHA1 2a09d325ca56c930b3afb1ee43c944fd4416b8e1
SHA512 2803f96729805c90143e0c4c9bf25398bac7d6e4402cb09be354c35566fc3c3bd9522372147c0e956bdbbc2943b9aecb0f5c96b527a26fd790b8fdb5b99efe10
MD5 SHA1 SHA512

Submit Download

button.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\button.tcl
Size 2KB
SHA256 391b6e333d16497c4b538a7bdb5b16ef11359b6e3b508d470c6e3703488e3b4d
MD5 ea7cf40852afd55ffda9db29a0e11322
SHA1 b7b42fac93e250b54eb76d95048ac3132b10e6d8
SHA512 123d78d6ac34af4833d05814220757dccf2a9af4761fe67a8fe5f67a0d258b3c8d86ed346176ffb936ab3717cfd75b4fab7373f7853d44fa356be6e3a75e51b9
MD5 SHA1 SHA512

Submit Download

clamTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\clamTheme.tcl
Size 4KB
SHA256 93c29536262c582104bf1804d7b06c7565b7d621f2e3605ff8b6c981a3b4ab01
MD5 beced087eeb3d5c9b2eabdb19c030d52
SHA1 be285e65905d335be442606afa3a88e408d5ec5b
SHA512 84b733c3fbe63c32b5b1e6cd132bd1b55f07b47612b70455c17c4d6d239682672c838cc3d739283079d0d2d8567fca9b763465d8d2148d25b5952282ed521a79
SSDEEP 48:9zDTlU3tCKW3PiAu4UZQsk+EBSucCtCqM368CtTU/+xgxaYgxaf/sY2+rF5usxzZ:ZuHjO7uCkqM3JCNU/igxNgxor2tFQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

classicTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\classicTheme.tcl
Size 3KB
SHA256 c7b1f40d77820fbaf2195f2bb3f334b38fec653fe47653f9e30a01ad4ca63ba5
MD5 70f3edfbfd4c16febdd8311290a0effe
SHA1 4b1d63d59c72c357931a8cbbf071654492a9b371
SHA512 a58c584ada6d271316266d58641be260f98e6fa0ae867ee9e343807a2955ddd3544b864cca80dc7f164ed4be5331575b696650ff0bb469c3647c5cb122f2a64c
MD5 SHA1 SHA512

Submit Download

combobox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\combobox.tcl
Size 11KB
SHA256 057f8f447de3a753714b8f82b96054e1849a2424749f3482492eae192baacdcf
MD5 06b885722c8555668bcbe8d7d9aa4c75
SHA1 8172c8886884de462549aa94fca440b99da90583
SHA512 d81ab53d48ed1d79da57fc2d2b599199ee985e237046244a2f820daacd2e8565c65d63e9b6f80175c30fd48290226a547d6d603293a4b7e4a455795f7fce7179
SSDEEP 192:l/9k9hqpFXQN9uK5Bt3NvnIW+KYNbruGL90t98VrQETczIT9QeSaQjJI1/P0lcLV:BhllSBtVL+mI0K
MD5 SHA1 SHA512 SSDEEP

Submit Download

cursors.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\cursors.tcl
Size 3KB
SHA256 7bdffa1c2692c5d1cf67b518f9acb32fa4b4d9936ed076f4db835943bc1a00d6
MD5 74596004dfdbf2ecf6af9c851156415d
SHA1 933318c992b705bf9f8511621b4458ecb8772788
SHA512 0d600b21db67bf9dadbdd49559573078efb41e473e94124ac4d2551bc10ec764846dc1f7674daa79f8d2a8aeb4ca27a5e11c2f30ede47e3ecee77d60d7842262
MD5 SHA1 SHA512

Submit Download

defaults.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\defaults.tcl
Size 4KB
SHA256 d83248b535a9417ce0ca598bbe245f24252adc90e3611c1191a045d9c0a9c99f
MD5 16843ecd9e716a87d865a6539ef44751
SHA1 3df76af0d6e4c386d63dd061100702dbb0f72a42
SHA512 7f5e7a200fd6b012a9336035211d9d89f0504f61156629ebcc1a03bcf8462ba8d219de376b6bb3ebb9e6a9507f0ac6f7d658eed5b953110df553b3c0c44ebc1d
SSDEEP 96:AMUoi/higxS4JAigxS4J/1+tDtj/x2f30QOdt:AMUoQhigQ42igQ4k+3n0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

entry.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\entry.tcl
Size 16KB
SHA256 fe32f8b154893218acaba93ac4b8e1170d9b3e3ab66df63df85c0a31c17592be
MD5 3dea98c515f6f731e666656da9708f12
SHA1 212865fc5c635eeca380efc1b3fbb85554714c47
SHA512 2901b5f92df95cbd1ec71acf86646af2f1d6058232eef1b5779192bad6df0bbbbc5902e363f809671f06d13270b1581d55f611556d48b1a843194477a113aeab
SSDEEP 192:hRy3ALQksU0oayTUQiZxIQzNiQfiEL8QmOhQVqknFoTOXyJtcC1JMuZm4FZxO25t:GoU7viEyOFWiTOEtcC1q252Ezp
MD5 SHA1 SHA512 SSDEEP

Submit Download

fonts.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\fonts.tcl
Size 5KB
SHA256 0eb518251fbe9cf0c9451cc1fef6bb6aee16d62da00b0050c83566da053f68d0
MD5 7017b5c1d53f341f703322a40c76c925
SHA1 57540c56c92cc86f94b47830a00c29f826def28e
SHA512 fd18976a8fbb7e59b12944c2628dbd66d463b2f7342661c8f67160df37a393fa3c0ce7fdda31073674b7a46e0a0a7d0a7b29ebe0d9488afd9ef8b3a39410b5a8
SSDEEP 96:Nduphbitcq1Zs/ZrBiZy227IhLkdhetOstWGbRafkeHH+4:3CheHvsbiZyDmJbRa3+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

menubutton.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\menubutton.tcl
Size 6KB
SHA256 d9af20135ef1bfeb3e0fd9fdabe821474de3ed43b3745a42fe564d24a8b9fd9c
MD5 fe89894d8cbf415541a60d77192f0f94
SHA1 c0716b2d8e24592757b62d24eeed57121b60e00f
SHA512 66488cbcac49cca47c9c560648e891d429f40e46549f58687b98073eba4807a8458a277be093ebfc50709a8a87a529df4e526eccfb60803ce16af17b97accd3d
SSDEEP 192:hfbJvnN+PN8JdNHC2yP9ZaOGOVyf1VdYwppcdhXk8dpK+dpKZxD2grrGAInehTOG:hfbRLRJDHco8zFzq6HG
MD5 SHA1 SHA512 SSDEEP

Submit Download

notebook.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\notebook.tcl
Size 5KB
SHA256 d1e5267cde3d7be408b4c94220f7e1833c9d452bb9ba3e194e12a5eb2f9adb80
MD5 82c9dfc512e143dda78f91436937d4dd
SHA1 26abc23c1e0c201a217e3cea7a164171418973b0
SHA512 a9d3c04ad67e0dc3f1c12f9e21ef28a61fa84dbf710313d4ca656bdf35dfbbfba9c268c018004c1f5614db3a1128025d795bc14b4fffaa5603a5313199798d04
SSDEEP 96:d4tDJf49tzG809fhQAKWCgQOK/6PF+hEi8YYFSL+3FJVCj0QlK2kfJcQIni:d4tktzwfWngQOK/6PF+hDDYFNJVCj0Q2
MD5 SHA1 SHA512 SSDEEP

Submit Download

panedwindow.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\panedwindow.tcl
Size 1KB
SHA256 ce0053d637b580170938cf552b29ae890559b98eb28038c2f0a23a265ddeb273
MD5 a12915fa5caf93e23518e9011200f5a4
SHA1 a61f665a408c10419fb81001578d99b43d048720
SHA512 669e1d66f1223cca6ceb120914d5d876bd3cf401ee4a46f35825361076f19c7341695596a7dbb00d6cff4624666fb4e7a2d8e7108c3c56a12bda7b04e99e6f9a
MD5 SHA1 SHA512

Submit Download

progress.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\progress.tcl
Size 1KB
SHA256 a9c34f595e547ce94ee65e27c415195d2b210653a9ffcfb39559c5e0fa9c06f8
MD5 b0074341a4bda36bcdff3ebcae39eb73
SHA1 d070a01cc5a787249bc6dad184b249c4dd37396a
SHA512 af23563602886a648a42b03cc5485d84fcc094ab90b08df5261434631b6c31ce38d83a3a60cc7820890c797f6c778d5b5eff47671ce3ee4710ab14c6110dcc35
MD5 SHA1 SHA512

Submit Download

scale.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\scale.tcl
Size 2KB
SHA256 25d0fe2b415292872ef7acdb2dfa12d04c080b7f9b1c61f28c81aa2236180479
MD5 b41a9df31924dea36d69cb62891e8472
SHA1 4c2877fbb210fdbbde52ea8b5617f68ad2df7b93
SHA512 a50db6da3d40d07610629de45f06a438c6f2846324c3891c54c99074cfb7beed329f27918c8a85badb22c6b64740a2053b891f8e5d129d9b0a1ff103e7137d83
MD5 SHA1 SHA512

Submit Download

scrollbar.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\scrollbar.tcl
Size 2KB
SHA256 b3a0e10c95b28c90cccfc373152bd30ab7da2fb4c0e96409aeeb01d453f36b4a
MD5 cf7bc1ffbf3efee2ca7369215a3b1473
SHA1 e2632241089f9dc47fa76cd0c57615d70753008c
SHA512 01841cda93aa0ce1a5b1fc65db153902b872b7e9d1030ef8902e086bbeb35649fd742dd96d1aed9cf620692fde6f4e2ccd865dc7a125452ffd16a65918956dda
MD5 SHA1 SHA512

Submit Download

sizegrip.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\sizegrip.tcl
Size 2KB
SHA256 717d2edd71076ea059903c7144588f8bbd8b0afe69a55cbf23953149d6694d33
MD5 3c8916a58c6ee1d61836e500a54c9321
SHA1 54f3f709698fad020a048668749cb5a09ede35ab
SHA512 2b71569a5a96cac1b708e894a2466b1054c3fae5405e10799b182012141634bd2a7e9e9f516658e1a6d6e9e776e397608b581501a6cfe2eb4ec54459e9ecb267
MD5 SHA1 SHA512

Submit Download

spinbox.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\spinbox.tcl
Size 4KB
SHA256 7c2ffd7308bdea852851335d5b5eb5dcca0e4d4a0cea16f786b40009ffd58b71
MD5 ebce661f8125f54c7dff9f076fb2bfe2
SHA1 966603a85eadba4e003e8307a7e581cd6839716f
SHA512 35f518e20986ab951ff33091f405ea1647534ccb77c8c36a94b1ab4a973df3ed52355864702b6526888830af8c912105e542027b5d68f81ac2a9f40ad2ba2632
SSDEEP 96:17n+wMf6/ocy2nO6locF+Ni2QQ0Q3LqwcsFLfhrxJSS3hQb:ln+wMOxVlh0Ni2QQ0QbksFLfhrxJzhQb
MD5 SHA1 SHA512 SSDEEP

Submit Download

treeview.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\treeview.tcl
Size 9KB
SHA256 0e05adf29b616989cb4724e57a26f1044598781f0cc10d5eb5ac4af7d705ddca
MD5 5bec78db1a86b4bc17a5108806c5371e
SHA1 4b2b08240f778864c5045f546a620702ae126ccb
SHA512 29dff439bb5caa23f8f38ea136406fa2db68be021068f80bad2e2ec811ae5c5b08f4f287719db946db780122af05654392ea771fb523bdc1569b364689d3ec86
SSDEEP 192:ZWeZ5BDFpkj+DsXibSyUMHLCGLdEpTBbZ:AeZ5BhypGKz
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttk.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\ttk.tcl
Size 4KB
SHA256 61baa0268770f127394a006340d99ce831a1c7ad773181c0c13122f7d2c5b7f6
MD5 e38b399865c45e49419c01ff2addce75
SHA1 f8a79cbc97a32622922d4a3a5694bccb3f19decb
SHA512 285f520b648f5ec70dd79190c3b456f4d6da2053210985f9e2c84139d8d51908296e4962b336894ee30536f09fae84b912bc2abf44a7011620f66cc5d9f71a8c
SSDEEP 96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
MD5 SHA1 SHA512 SSDEEP

Submit Download

utils.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\utils.tcl
Size 8KB
SHA256 6c35cd6c7f3ac4be3fe0cc7633dbbde5123155921a441ba702b4347e6f967f34
MD5 f868a26a299885824b14ca28f68039ce
SHA1 e37a1889e6cc215102ec078d0455622415ed8486
SHA512 14d8fd30fe670ce4630ce5b7b1e4b04a2a3f97d6483d87d0d7a2b675e880ab75e947820a4babd337452d683e0cbb7b92b4c866af19a8dcd5711016e012d597e2
SSDEEP 192:MpEpXI4jqmW/y3gp9F+QE9PBRc+vWHJOfqH2pmKQ8xPeR3ohwxD:6yXuwg1oPnc+epO7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

vistaTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\vistaTheme.tcl
Size 9KB
SHA256 ce1a53a769de9e230f586efafd2fb455980b45941e5db553bd3a2f0062b50f3e
MD5 ad2d78020875529834dd0ea74251e2d3
SHA1 80cc99972a056396dd55e9505ccb02e16462b115
SHA512 59ec21a44769fec0b462f0675217882ecf5cbc64056024e4259d91233a1397b4b89957bd474387c992a8753dc9c350fda7e6e5c6e9d29c655d62362a018e2194
SSDEEP 192:kSsdZjgE2kiSCyNPNVVSCIA5l/r5l/rW+i/CE38S7r/2JeJnpna+yfdyMq53ICyB:QZjD2kFVeArPKJ3z7cQ0383cdd
MD5 SHA1 SHA512 SSDEEP

Submit Download

winTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\winTheme.tcl
Size 2KB
SHA256 05fad058280e7a8947a9f71122b442b92d7d578b4618b08bf0b71b6dac5aa22f
MD5 8b4813a1c6915fd35b52ac854230bcc1
SHA1 db981087f2a311361446014fadbd8b199d856716
SHA512 e0a69e94aabd725b441d6c4920f1cd54451bcc00090d9319cb55286a46a7f35066d1959de149d900198f777671004f6d8a64e7d31e42f8a76e89ed122a79a9ff
MD5 SHA1 SHA512

Submit Download

xpTheme.tcl

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\tk\ttk\xpTheme.tcl
Size 2KB
SHA256 ff421674388da5d3a0c687f342f8d1e3c7f247f3cb59d5512b31f91a54a4c318
MD5 1026799ffe26aaa8661f64d6f2cbe4dd
SHA1 5cd337feb3130d146134e06c4a1826ba29157e7a
SHA512 90f1062caa87c0d65aede1d71370ebe35ad90f4033e6077169b7168b4754c0ff46a9f6348f4d907dcf20ab8f63bb6e0d106a05f068c5abeb86d26f5ea00f503c
MD5 SHA1 SHA512

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_720_133631085404938788\vcruntime140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

prism.exe

Path C:\Users\Admin\AppData\Local\Temp\prism.exe
Size 5.0MB
SHA256 e209fa6557cfe3d8d0ad23e32afbe0767609ce30765bd31362242fa34ea74728
MD5 3c234d63acc712e09a6ed9a6da5687fe
SHA1 b755b122383a1c2fe1b4e4b6cba267b51a424cca
SHA512 ccb03765f1dda8291cb1baf711d23b6f2d31b6d762cc295cd43e5e6422540839e5711488016698e12ac8793ecf7c4b6c8fe654b35efdb2166c86b588a68fdd41
SSDEEP 98304:lMLbj8BVXACSOk4m0RN1De18OgR5pduOsegiVymqRZdj6zXJb:lMfIS4tryW5FgiVyFpjqXd
MD5 SHA1 SHA512 SSDEEP

Submit Download

yxswer.exe

Path C:\Users\Admin\AppData\Local\Temp\yxswer.exe
Size 32.9MB
SHA256 9009e81844ccd7abe82324b44b8170dc260b153648e7d0d8bef4449916e3d525
MD5 cbd5a15f6ee7f3ecea1b42a2307d4d9c
SHA1 cdd0e805d9995a8a2c7d01e3ee4e0fcd21ce24bc
SHA512 f734007d3bda9122e825977b34c8c2240d4e99ca9f0076f98e4b334c21b90ab071eeed96394f1c8e7ed1f08f3ebccca45c071b8a0147d49af9de1d03195a6933
SSDEEP 786432:/4HS80aZdHbirIOK2Iij14ST6Vkl/+Mk0SlZ:AS80c72H54ST6VO+lZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dllhost.exe

Path C:\Users\Admin\dllhost.exe
Size 78KB
SHA256 34be6a934fd45752e788f9ba20943c8e52d91732d76e9f30a5176e98dccd956e
MD5 4a7f75343aaa5a4d8d18add50ccf3139
SHA1 110c62eee6d7deb4aa9d601c942eae43482d2125
SHA512 1f1516fc41e0b90d0d47e306da15a542799425159f4ad476cf4fd88b9b56d200c79c72ce29ca5b0acf2a195cabe803c37c72b8d76e99a69a04dbfe1fb9f9fc79
SSDEEP 1536:394nZfXa628KE+EE9qEGJ4Ybpf72rYlYl76aOdX9mGl:qnZfK628dFEFYbB2IyOdX/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-1058-0x0000016FEAF60000-0x0000016FEB17C000-memory.dmp

Download

memory/1340-1046-0x0000016FEA960000-0x0000016FEA982000-memory.dmp

Download

memory/3772-1071-0x000001BDEFCE0000-0x000001BDEFEFC000-memory.dmp

Download

memory/4348-392-0x00000000050B0000-0x0000000005116000-memory.dmp

Download

memory/4348-117-0x0000000005130000-0x0000000005758000-memory.dmp

Download

memory/4348-69-0x0000000002800000-0x0000000002836000-memory.dmp

Download

memory/4348-990-0x0000000005E00000-0x0000000005E4C000-memory.dmp

Download

memory/4348-393-0x00000000057D0000-0x0000000005836000-memory.dmp

Download

memory/4348-1042-0x0000000007640000-0x0000000007CBA000-memory.dmp

Download

memory/4348-1043-0x00000000062D0000-0x00000000062EA000-memory.dmp

Download

memory/4348-1044-0x0000000008270000-0x0000000008814000-memory.dmp

Download

memory/4348-1045-0x00000000071B0000-0x0000000007242000-memory.dmp

Download

memory/4348-989-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Download

memory/4348-593-0x0000000005940000-0x0000000005C94000-memory.dmp

Download

memory/4348-49-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Download

memory/4348-33-0x000000007370E000-0x000000007370F000-memory.dmp

Download

memory/4348-121-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Download

memory/4348-259-0x0000000004F10000-0x0000000004F32000-memory.dmp

Download

memory/4720-39-0x00007FFB6B3F3000-0x00007FFB6B3F5000-memory.dmp

Download

memory/4720-1100-0x00007FFB6B3F3000-0x00007FFB6B3F5000-memory.dmp

Download

memory/4720-42-0x00000000005A0000-0x00000000005BA000-memory.dmp

Download