78d07c04a90c3ce94f7a70748cc841f43a7229639a2675725c511e4b15866031

Analysis

user interaction
yes
max time kernel
48s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Permspoofer.exe
Size 1.8MB
Sample260728-p29lsaxaqa
SHA256 78d07c04a90c3ce94f7a70748cc841f43a7229639a2675725c511e4b15866031
MD5 aed94991a4236be469ba6b05cf3babcc
SHA1 d2aeb03ad8e646c0acc4908246d942dd9381ea6a
SHA512 6c37736ee2cdda0cc529ede50ad53d4656cf6fd850665db51c85e1bd462385b34ac7043bfdac4d5bf6c0e5c46344b9a7a482b07812205c13bf0259c28c67a3bf
SSDEEP 24576:PFOa+7vwe+8ljws5G8Nc9sOgSNMMFJAyAL+3Xw2PP6MReN/IAUqNOmNAFwa/kjX:t6gqdG8Nc9sOxtJVw2nzA3s/E
TLSH
T1E3954B4BE7A321E4D876C1788592232AF9B07C6843349FD77398450A0F72BE4AE3D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
3116	permspoofer.exe
5424	icsys.icn.exe
2140	explorer.exe
2864	spoolsv.exe
3604	svchost.exe
248	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Permspoofer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7524	cmd.exe
8052	cmd.exe
9000	Process not Found
4348	Process not Found
5464	Process not Found
6344	Process not Found
4924	cmd.exe
9536	Process not Found
3304	cmd.exe
424	cmd.exe
8292	Process not Found
8824	Process not Found
8724	Process not Found
9408	Process not Found
11204	Process not Found
4864	cmd.exe
3320	cmd.exe
7872	cmd.exe
3136	cmd.exe
1576	cmd.exe
7772	cmd.exe
9940	Process not Found
10224	Process not Found
9684	Process not Found
2236	cmd.exe
7916	cmd.exe
4072	cmd.exe
4720	Process not Found
9284	Process not Found
11112	Process not Found
8780	Process not Found
2508	Process not Found
9616	Process not Found
1932	cmd.exe
7804	cmd.exe
7652	cmd.exe
2972	Process not Found
5924	cmd.exe
6544	cmd.exe
5256	Process not Found
11064	Process not Found
6168	cmd.exe
8084	cmd.exe
10716	Process not Found
2872	cmd.exe
3048	cmd.exe
9028	Process not Found
10252	Process not Found
1908	cmd.exe
7932	cmd.exe
9200	Process not Found
11256	Process not Found
6796	cmd.exe
8156	Process not Found
2808	cmd.exe
7000	cmd.exe
4136	cmd.exe
7084	cmd.exe
9400	Process not Found
9264	Process not Found
10720	Process not Found
10492	Process not Found
10312	Process not Found
7716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Permspoofer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
2900	taskkill.exe
8576	Process not Found
5876	Process not Found
10308	Process not Found
6672	taskkill.exe
1920	taskkill.exe
11144	Process not Found
4376	taskkill.exe
1164	taskkill.exe
6800	taskkill.exe
7812	taskkill.exe
8660	Process not Found
8624	Process not Found
1192	Process not Found
4812	Process not Found
8372	Process not Found
1256	taskkill.exe
7908	taskkill.exe
3864	taskkill.exe
6632	taskkill.exe
6236	taskkill.exe
6760	taskkill.exe
4148	taskkill.exe
3008	taskkill.exe
7488	taskkill.exe
7656	taskkill.exe
9588	Process not Found
1796	taskkill.exe
4160	taskkill.exe
6720	taskkill.exe
8312	Process not Found
6156	taskkill.exe
3004	Process not Found
8040	taskkill.exe
5688	taskkill.exe
9152	Process not Found
1360	Process not Found
9492	Process not Found
1000	taskkill.exe
8164	taskkill.exe
8332	Process not Found
10480	Process not Found
6852	Process not Found
3616	taskkill.exe
4996	taskkill.exe
6752	taskkill.exe
7044	taskkill.exe
8028	taskkill.exe
7688	taskkill.exe
9044	Process not Found
3244	Process not Found
8176	taskkill.exe
7600	taskkill.exe
9984	Process not Found
10076	Process not Found
8800	Process not Found
792	taskkill.exe
4628	taskkill.exe
8268	Process not Found
4624	Process not Found
8916	Process not Found
10000	Process not Found
8460	Process not Found
9844	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5804	Permspoofer.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
3116	permspoofer.exe
3116	permspoofer.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
5424	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2140	explorer.exe
3604	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	4312	taskkill.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	3156	taskkill.exe
Token: SeDebugPrivilege	2052	taskkill.exe
Token: SeDebugPrivilege	3288	taskkill.exe
Token: SeDebugPrivilege	3396	taskkill.exe
Token: SeDebugPrivilege	1784	taskkill.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	5880	taskkill.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	5000	taskkill.exe
Token: SeDebugPrivilege	5696	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	5980	taskkill.exe
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeDebugPrivilege	3512	taskkill.exe
Token: SeDebugPrivilege	6100	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	3776	taskkill.exe
Token: SeDebugPrivilege	476	taskkill.exe
Token: SeDebugPrivilege	5292	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	4384	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	5536	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	5584	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	2552	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	3864	taskkill.exe
Token: SeDebugPrivilege	3496	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	6128	taskkill.exe
Token: SeDebugPrivilege	4784	taskkill.exe
Token: SeDebugPrivilege	2636	taskkill.exe
Token: SeDebugPrivilege	5492	taskkill.exe
Token: SeDebugPrivilege	2468	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	6016	taskkill.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	5212	taskkill.exe
Token: SeDebugPrivilege	2104	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	1540	taskkill.exe
Token: SeDebugPrivilege	4056	taskkill.exe
Token: SeDebugPrivilege	5452	taskkill.exe
Token: SeDebugPrivilege	5548	taskkill.exe
Token: SeDebugPrivilege	1448	taskkill.exe
Token: SeDebugPrivilege	1100	taskkill.exe
Token: SeDebugPrivilege	700	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	3204	taskkill.exe
Token: SeDebugPrivilege	5688	taskkill.exe
Token: SeDebugPrivilege	3516	taskkill.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5804	Permspoofer.exe
5804	Permspoofer.exe
5424	icsys.icn.exe
5424	icsys.icn.exe
2140	explorer.exe
2140	explorer.exe
2864	spoolsv.exe
2864	spoolsv.exe
3604	svchost.exe
3604	svchost.exe
248	spoolsv.exe
248	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 3116	5804	Permspoofer.exe	89
PID 5804 wrote to memory of 5424	5804	Permspoofer.exe	91
PID 3116 wrote to memory of 6108	3116	permspoofer.exe	92
PID 6108 wrote to memory of 3580	6108	cmd.exe	93
PID 5424 wrote to memory of 2140	5424	icsys.icn.exe	94
PID 2140 wrote to memory of 2864	2140	explorer.exe	96
PID 2864 wrote to memory of 3604	2864	spoolsv.exe	97
PID 3604 wrote to memory of 248	3604	svchost.exe	98
PID 3116 wrote to memory of 2512	3116	permspoofer.exe	99
PID 2512 wrote to memory of 4312	2512	cmd.exe	100
PID 3116 wrote to memory of 5580	3116	permspoofer.exe	101
PID 3116 wrote to memory of 5060	3116	permspoofer.exe	102
PID 5060 wrote to memory of 1076	5060	cmd.exe	103
PID 3116 wrote to memory of 2868	3116	permspoofer.exe	104
PID 2868 wrote to memory of 3156	2868	cmd.exe	105
PID 3116 wrote to memory of 4728	3116	permspoofer.exe	106
PID 4728 wrote to memory of 2052	4728	cmd.exe	107
PID 3116 wrote to memory of 1884	3116	permspoofer.exe	108
PID 1884 wrote to memory of 3288	1884	cmd.exe	109
PID 3116 wrote to memory of 2948	3116	permspoofer.exe	110
PID 2948 wrote to memory of 3396	2948	cmd.exe	111
PID 3116 wrote to memory of 3304	3116	permspoofer.exe	114
PID 3304 wrote to memory of 1784	3304	cmd.exe	115
PID 3116 wrote to memory of 4124	3116	permspoofer.exe	116
PID 4124 wrote to memory of 1716	4124	cmd.exe	117
PID 3116 wrote to memory of 5856	3116	permspoofer.exe	118
PID 5856 wrote to memory of 5880	5856	cmd.exe	119
PID 3116 wrote to memory of 4612	3116	permspoofer.exe	120
PID 4612 wrote to memory of 620	4612	cmd.exe	121
PID 3116 wrote to memory of 1176	3116	permspoofer.exe	122
PID 1176 wrote to memory of 5000	1176	cmd.exe	123
PID 3116 wrote to memory of 5296	3116	permspoofer.exe	124
PID 5296 wrote to memory of 5696	5296	cmd.exe	125
PID 3116 wrote to memory of 2668	3116	permspoofer.exe	126
PID 2668 wrote to memory of 1668	2668	cmd.exe	127
PID 3116 wrote to memory of 1308	3116	permspoofer.exe	128
PID 1308 wrote to memory of 5472	1308	cmd.exe	129
PID 3116 wrote to memory of 3260	3116	permspoofer.exe	130
PID 3260 wrote to memory of 1612	3260	cmd.exe	131
PID 3116 wrote to memory of 4800	3116	permspoofer.exe	132
PID 4800 wrote to memory of 5980	4800	cmd.exe	133
PID 3116 wrote to memory of 3340	3116	permspoofer.exe	134
PID 3340 wrote to memory of 4560	3340	cmd.exe	135
PID 3116 wrote to memory of 4604	3116	permspoofer.exe	136
PID 4604 wrote to memory of 3512	4604	cmd.exe	137
PID 3116 wrote to memory of 4972	3116	permspoofer.exe	138
PID 4972 wrote to memory of 6100	4972	cmd.exe	139
PID 3116 wrote to memory of 4476	3116	permspoofer.exe	140
PID 4476 wrote to memory of 2748	4476	cmd.exe	141
PID 3116 wrote to memory of 3192	3116	permspoofer.exe	142
PID 3192 wrote to memory of 2964	3192	cmd.exe	143
PID 3116 wrote to memory of 4156	3116	permspoofer.exe	144
PID 4156 wrote to memory of 3776	4156	cmd.exe	145
PID 3116 wrote to memory of 5924	3116	permspoofer.exe	146
PID 5924 wrote to memory of 476	5924	cmd.exe	147
PID 3116 wrote to memory of 5756	3116	permspoofer.exe	148
PID 5756 wrote to memory of 5292	5756	cmd.exe	149
PID 3116 wrote to memory of 3504	3116	permspoofer.exe	150
PID 3504 wrote to memory of 3420	3504	cmd.exe	151
PID 3116 wrote to memory of 5724	3116	permspoofer.exe	152
PID 5724 wrote to memory of 4384	5724	cmd.exe	153
PID 3116 wrote to memory of 3576	3116	permspoofer.exe	154
PID 3576 wrote to memory of 4632	3576	cmd.exe	155
PID 3116 wrote to memory of 1916	3116	permspoofer.exe	156

C:\Users\Admin\AppData\Local\Temp\Permspoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Permspoofer.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5804
- \??\c:\users\admin\appdata\local\temp\permspoofer.exe
  c:\users\admin\appdata\local\temp\permspoofer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5296
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:1916
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:4472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:2036
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:5020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:2020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:3184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2756
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1080
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4596
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:3940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:1136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:4500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:2256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:1064
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:5328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:2084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:4692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:5644
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:5960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:5484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:3920
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:5972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:5016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:1372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:2380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:2120
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:4256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:4280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1908
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:4388
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:5976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:4332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:5076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:5620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3276
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:3404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:5048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:4284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:3780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:3376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:5940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:5904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:5848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:2708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4548
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:912
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4876
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:4108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:2520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:2880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:3392
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:4084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:1624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:1068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:5144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:3816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:2252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:2856
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:3312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:2976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:5720
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:2608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:4732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:3456
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:2076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      Kills process with taskkill
      PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:2408
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:3820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:3640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:1048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:2488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:3432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:3524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:1336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:5312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:2440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:424
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:6116
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:5080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      Kills process with taskkill
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:3356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:4608
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:4240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:2572
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:6028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:5692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2596
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3428
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:3536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2888
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:1000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:2744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:5808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:3052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:1608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:3452
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:5672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:5680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:2932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:1544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:4656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:1888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:5868
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:1812
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:3596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:4736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:4844
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:5428
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:4380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:3544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:5708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:3256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:5840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:5348
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      Kills process with taskkill
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:3556
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:2264
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:4372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:4368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:3788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      Kills process with taskkill
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:5968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:1528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:5648
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:2300
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:1904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:2700
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:2260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:4524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:4976
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:1364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:5012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:4460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:5208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:1216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2500
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:752
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4288
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:5588
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:4780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:4508
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:1188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2808
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:4928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:2272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:6104
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:5948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:4412
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:2444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:2664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:4904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:2132
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:2144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:4724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:3508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:5568
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:2616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:1172
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:1152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:5040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:2592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:1848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:4052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:3032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:2624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:2200
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:1632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:4792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      Kills process with taskkill
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:3468
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2536
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:2484
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:3040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:5816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:4744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:5272
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:948
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:2268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:1220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:2524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3600
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:5900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1328
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:716
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:1628
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:3352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:5684
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:5440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:5148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:6004
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:1252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:4128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2872
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:2860
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:2848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:4164
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:5468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:3476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:2424
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:3680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:3440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:1912
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:1288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:3880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:2680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:2044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:6008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:5576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      Kills process with taskkill
      PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:5252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:5708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:4576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:3324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:5532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:4704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:4308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:3408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:4064
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      Kills process with taskkill
      PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1140
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:4832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:1376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:5092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:5984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:2576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:5340
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:1972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:5952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:6020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3076
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:960
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:5608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1200
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:5640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:4340
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:4204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6036
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:4532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:928
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:5748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:2528
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:5008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:2376
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:3832
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:1092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:5488
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:5052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:3564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:1388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:2060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:5032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:6152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:6164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:6180
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:6192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:6228
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:6240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:6276
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:6288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:6324
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:6336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:6372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:6384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:6420
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:6432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:6468
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:6480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:6496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:6508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6544
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:6556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:6596
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:6608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:6644
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:6656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:6692
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:6704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:6740
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Kills process with taskkill
      PID:6752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      PID:6800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:6836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:6848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:6884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:6896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:6932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:6944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:6980
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:6992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:7032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:7044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7080
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:7092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7128
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:7140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:4184
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:6160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:1316
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:6264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:6320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:6296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6360
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:6356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:6408
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:6376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:6440
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:6316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:6512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:6560
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:6552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:6616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:6536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:6648
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      Kills process with taskkill
      PID:6720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:6768
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      Kills process with taskkill
      PID:6760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:6812
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:6808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:6868
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:6888
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:6976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:6828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:7004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7000
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:6876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:7040
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:7108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:4512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:7148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:6176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:6216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:6208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:6256
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:6312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:6220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:6416
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:6340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:6392
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:6532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:6368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:6576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:6624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      Kills process with taskkill
      PID:6632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:6668
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:6672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:6708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:6588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6636
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:6612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:6904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:6900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:6952
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:6968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:7008
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:7036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:6860
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:7096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:7132
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:7144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2904
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:6044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:6260
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:6200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:6272
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:6452
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:6444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:6476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      Kills process with taskkill
      PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:6592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:6580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6716
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:6540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:6744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:6776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:6880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:6732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:7004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:6960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:6804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:7088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:6204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:6936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:6148
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:6188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:6212
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:6448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:4140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:6484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:6520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:6628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:6620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:6564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:6756
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:6600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:6796
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:6820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:6856
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:6996
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:7064
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:7012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:7020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:6304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:6292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:6252
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:6388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:6328
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:6424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:6492
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:6412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:6396
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:6684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:6928
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:6524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:7016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:6964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:6364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:7152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:6664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:7072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:6292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:6400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:6196
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:3588
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:6584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:6908
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:6460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:1340
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:6920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:6780
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:6172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:3568
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:6472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:6500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:6308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6676
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:6604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:6640
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:6892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:7048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:6504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:2472
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:1800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:6280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:6436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:6864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:7160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:6840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      Kills process with taskkill
      PID:6156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:6972
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:6404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:7068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:5792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:6712
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:6916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:7100
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:6352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:6284
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:7136
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:7060
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:6568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:1732
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:2400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:6956
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:5612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:2652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:6912
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:6688
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:6724
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:7156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:6824
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:5944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:6696
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2640
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:6940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:4600
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:5204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:6924
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:6792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:6680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:2080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:6380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:6232
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:6456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:4468
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7184
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:7196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7232
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:7244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7280
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:7292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:7332
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:7344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:7380
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:7428
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:7440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:7476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      PID:7488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7524
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:7536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:7576
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:7588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:7624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:7636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:7672
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:7684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:7720
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:7736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7772
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:7784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:7820
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:7832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:7868
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:7880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7916
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:7928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:7964
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:7976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:8016
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      Kills process with taskkill
      PID:8028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:8044
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:8056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:8092
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:8104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:8140
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:8152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:8188
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:6660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:7212
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:7276
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:7256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:7312
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:7300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:7288
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:7336
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:7404
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:7400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:7448
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:5920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7480
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:7552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:7620
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:7604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:7668
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:7648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7716
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:7696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:1840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:7748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:7816
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:7796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:7864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:7844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:7892
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:7900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7948
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:7924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7984
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:8040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:8064
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:8080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:8124
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:8100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:8160
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:8084
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:7188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:7248
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:7252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:7308
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:7192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:7424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:7456
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:7272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:7520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:7324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:7532
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:7568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4072
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:7516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:4516
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      Kills process with taskkill
      PID:7688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:7616
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:7724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:7788
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:7800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:7840
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:7884
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:4620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:7920
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:8032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:7912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:8076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:8168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:5912
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      Kills process with taskkill
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3048
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:7296
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:7240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:7368
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:6784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:2168
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:7496
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:7472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:7500
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:7176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:2792
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:7640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7512
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:7704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:7776
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:7852
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:7712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7932
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:7856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:8020
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:8088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:8112
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:7972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:8184
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:8060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:6748
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      PID:7320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7956
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:7364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:5152
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:7360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7340
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:7540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:7236
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:7420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:7632
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:7680
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:7508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:4520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:7756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:7904
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:8024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:7764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:7940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:7580
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:7944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:6464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:7204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:7216
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:7268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      Kills process with taskkill
      PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:8128
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:2752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:7432
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:4820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:7564
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:7628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    PID:7828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      PID:7824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7804
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:7760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:7848
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:7664
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:7560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:7968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:8116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:7468
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      PID:8008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:8068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:8132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:7436
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:7544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:7612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:7596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7652
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:7464
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:7692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:8000
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:4860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:7836
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:8172
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:7860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:8180
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      PID:7264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:7412
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      Kills process with taskkill
      PID:7908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Ida64.exe >nul 2>&1
    3⤵
    PID:6728
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Ida64.exe
      4⤵
      PID:7452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:7220
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:7528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg64.exe >nul 2>&1
    3⤵
    PID:7708
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg64.exe
      4⤵
      PID:7808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Dbg32.exe >nul 2>&1
    3⤵
    PID:8144
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Dbg32.exe
      4⤵
      PID:8120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Taskmgr.exe >nul 2>&1
    3⤵
    PID:7260
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:7812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7316
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
      4⤵
      PID:8072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:2804
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      Kills process with taskkill
      PID:7656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
    3⤵
    PID:7416
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
      4⤵
      PID:7992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumperClient.exe >nul 2>&1
    3⤵
    PID:7384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumperClient.exe
      4⤵
      PID:7996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:7744
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:8108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
    3⤵
    PID:7504
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerUI.exe
      4⤵
      Kills process with taskkill
      PID:8164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
    3⤵
    PID:6224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTPDebuggerSvc.exe
      4⤵
      PID:7328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im ProcessHacker.exe >nul 2>&1
    3⤵
    PID:7584
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im ProcessHacker.exe
      4⤵
      PID:7780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq.exe >nul 2>&1
    3⤵
    PID:1032
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq.exe
      4⤵
      PID:7792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im idaq64.exe >nul 2>&1
    3⤵
    PID:8148
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im idaq64.exe
      4⤵
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Wireshark.exe >nul 2>&1
    3⤵
    PID:7224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Fiddler.exe >nul 2>&1
    3⤵
    PID:8096
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Fiddler.exe
      4⤵
      PID:1156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im FiddlerEverywhere.exe >nul 2>&1
    3⤵
    PID:1436
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im FiddlerEverywhere.exe
      4⤵
      PID:7936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos64.exe >nul 2>&1
    3⤵
    PID:7492
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos64.exe
      4⤵
      PID:7740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos.exe >nul 2>&1
    3⤵
    PID:7960
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos.exe
      4⤵
      PID:7676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Xenos32.exe >nul 2>&1
    3⤵
    PID:7348
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Xenos32.exe
      4⤵
      PID:7876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im de4dot.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:7872
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im de4dot.exe
      4⤵
      Kills process with taskkill
      PID:8176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im Cheat Engine.exe >nul 2>&1
    3⤵
    PID:6988
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im Cheat Engine.exe
      4⤵
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    PID:7592
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:7660
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64-SSE4-AVX2.exe
      4⤵
      PID:7700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe >nul 2>&1
    3⤵
    PID:5068
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-x86_64-SSE4-AVX2.exe
      4⤵
      PID:7396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im MugenJinFuu-i386.exe >nul 2>&1
    3⤵
    PID:7460
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im MugenJinFuu-i386.exe
      4⤵
      Kills process with taskkill
      PID:7600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-x86_64.exe >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:8052
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-x86_64.exe
      4⤵
      PID:7284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im cheatengine-i386.exe >nul 2>&1
    3⤵
    PID:7388
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im cheatengine-i386.exe
      4⤵
      PID:4836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im HTTP Debugger Windows Service (32 bit).exe >nul 2>&1
    3⤵
    PID:8012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im HTTP Debugger Windows Service (32 bit).exe
      4⤵
      PID:7988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im KsDumper.exe >nul 2>&1
    3⤵
    PID:7752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im KsDumper.exe
      4⤵
      PID:7980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im OllyDbg.exe >nul 2>&1
    3⤵
    PID:7356
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im OllyDbg.exe
      4⤵
      PID:7556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x64dbg.exe >nul 2>&1
    3⤵
    PID:7304
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x64dbg.exe
      4⤵
      PID:7768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im x32dbg.exe >nul 2>&1
    3⤵
    PID:7896
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im x32dbg.exe
      4⤵
      PID:8136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
    3⤵
    PID:8200
  - - C:\Windows\system32\taskkill.exe
      taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
      4⤵
      PID:8212
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5424
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2864
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3604
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

permspoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\permspoofer.exe
Size 1.7MB
SHA256 5ac5405bbad830e2aceffa5f7042a966b0c94c7e1c9b04e3f2a6289bc7254759
MD5 ea94fea54e5edbeeb84d600b3996d6a5
SHA1 041c399096e73ad102b59a84cdd630de851ed43b
SHA512 883c332f5f21a0f74d833be19abe087bf08a97f27b4ea0505d0822b535ba7c229483fd5917b585964c9463ea17d367c3089eaea22c7f0b875b9013b70d571176
SSDEEP 24576:57vwe+8ljws5G8Nc9sOgSNMMFJAyAL+3Xw2PP6MReN/IAUqNOmNAFwa/kj:5gqdG8Nc9sOxtJVw2nzA3s/
TLSH
T1EE854C4BE7A321E4D876D1788592232AF970786883349BD7739C451A0F32BF4AE3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 3fea555a67ff2b67e3998e0b0d4efe38c7130184a51ea086b038346d1f397d20
MD5 e4387057db817543d4e176f34098c7b4
SHA1 b9cc14baa1abb45e2663dbfdd322a70dd706a915
SHA512 d761a1b5e1457d6d9e8825fd961ce747123473bcced91cee754c28723a30b18f64eb6085e7dc62d0b77f48768bbbc401da7eb9a86be6b108bed2d8d6d92102fb
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXG:UVqoCl/YgjxEufVU0TbTyDDalRG
TLSH
T199D30A1B7E50942EE852C9F128A5E7A97AA21F390BF06E0772767B4039B124375F170F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 009588dad600534e5647a43a8d8be84a46832808b466725a07bff09eb8c92d64
MD5 729840a8e39ee4cbb7dfff9e03054375
SHA1 8067e75fca733bcd7d818cbdc6d172a1efeeaf69
SHA512 4ac9bb0651628c49d36d6cfb166a14a11f9c0b21e94206323e8ce7db0d8ec06002991fd4513f45538d8d312df1dd23eaf166efa73d08b4c8bdcbce9675c5b206
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXQ:UVqoCl/YgjxEufVU0TbTyDDalRQ
TLSH
T10CD31C13FE51141EE862C9F07865FB6AB9695E3A0BE49C073252BB15357A243B1F830F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 a64c43f36bb676e0eeb1e4e0b7961f4a5357fb4b86ccf2b6614cc610832c142d
MD5 7a85e056194267106e0f62f8011aeec4
SHA1 f9d06e1a7ce886b71d3ee871ff214487e4bc08ef
SHA512 613905b8b5f40c0871af3ff7568869b26bcf4885d0b0d69b0b83b6ee3e184e4e4e8b4bed1bb576d91eee7dfaa87ff6c22697ef35d8e9c7fa18e56b58f8854759
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXE:UVqoCl/YgjxEufVU0TbTyDDalRE
TLSH
T146D32813BF50543ED95285F028F6EA5EB6221E362BD0AD0B364ABF016A7654732F530F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 7ee5937f131c036bbf8f4b68abc12c24121da6c74202f87c2c55de83d92238b3
MD5 39a4ca10291d4216a95915a290b6b191
SHA1 94a4cf3dbc54ddcf2ca7f68836f1be869b2d5292
SHA512 4ed6c01ddc5bc8280470bf2e2fad33d522fcc9940a9c9e3fc149dd6f41d68d4230717ae4a1bde1e476e795b8a0c461e2bece09fd18f5604e2ed2edf7014c457f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVX9:UVqoCl/YgjxEufVU0TbTyDDalR9
TLSH
T153D3F823AF10502EE461C5F26C76E66EB9215E391FE1AD0772A2FB0076B1643B5F520F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-48-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2140-52-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2864-49-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3604-53-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5424-50-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5804-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5804-51-0x0000000000400000-0x000000000041F000-memory.dmp

Download