ad3d778bebeac6354db82f107ca9568961004a94bb4197f58abcef3626018e9d

Analysis

user interaction
yes
max time kernel
27s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c53ae83986aff5bd0ddff8aec0e9aa669c.exe
Size 21.0MB
Sample261113-tp9s8sdv5x
SHA256 ad3d778bebeac6354db82f107ca9568961004a94bb4197f58abcef3626018e9d
MD5 80d3b89ae732e440aa9749d1fbdfa905
SHA1 8cb0f5cc441ccc5e4247862ed2aba762243cd0ed
SHA512 421b742a6bef9465a0527416883ec0309f851f19edcd09e6a92cfb5db9e6ff5ccd4a01a53ee942c5409895e27800985c22d553d11792e82fef601af1b582a4e9
SSDEEP 393216:DvzQQ4EC4/uKV3Z51wtwLocejzVG18xnylza6But5t1Q:zzQofdLW0Va6Mt
TLSH
T11F2723D35C8462F4E3E74B10918B228E7BD13162DE96D90D15C8A8032FA3D97974BE6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2488	cmd.exe
3360	ARP.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3880	sc.exe
3360	sc.exe
1408	sc.exe
1924	sc.exe
6124	sc.exe
5480	sc.exe
4616	sc.exe
5284	sc.exe
2104	sc.exe
2456	sc.exe
2956	sc.exe
5696	sc.exe
2388	sc.exe
1944	sc.exe
3544	sc.exe
2912	sc.exe
1724	sc.exe
5212	sc.exe
4820	sc.exe
2956	sc.exe
5736	sc.exe
5572	sc.exe
3312	sc.exe
3336	sc.exe
2272	sc.exe
4528	sc.exe
1776	sc.exe
5028	sc.exe
5404	sc.exe
4364	sc.exe
2104	sc.exe
2148	sc.exe
5420	sc.exe
5572	sc.exe
5636	sc.exe
3980	sc.exe
5024	sc.exe
4772	sc.exe
1384	sc.exe
4460	sc.exe
5892	sc.exe
5216	sc.exe
560	sc.exe
4032	sc.exe
1264	sc.exe
4336	sc.exe
3280	sc.exe
2748	sc.exe
684	sc.exe
5892	sc.exe
4508	sc.exe
3696	sc.exe
1948	sc.exe
4272	sc.exe
1276	sc.exe
4348	sc.exe
3132	sc.exe
1680	sc.exe
2536	sc.exe
1724	sc.exe
3132	sc.exe
5036	sc.exe
3196	sc.exe
4204	sc.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5372	cmd.exe
5248	cmd.exe
4768	cmd.exe
1420	cmd.exe
2228	cmd.exe
3840	cmd.exe
3428	cmd.exe
4264	cmd.exe
3184	cmd.exe
4956	cmd.exe
5328	cmd.exe
216	cmd.exe
4588	cmd.exe
5968	cmd.exe
4332	cmd.exe
5244	cmd.exe
5772	cmd.exe
5576	cmd.exe
1004	cmd.exe
4944	cmd.exe
3136	cmd.exe
5408	cmd.exe
4716	cmd.exe
4692	cmd.exe
1964	cmd.exe
4068	cmd.exe
5156	cmd.exe
2408	cmd.exe
4180	cmd.exe
3968	cmd.exe
5680	cmd.exe
1688	cmd.exe
4204	cmd.exe
3804	cmd.exe
4320	cmd.exe
4228	cmd.exe
5700	cmd.exe
5912	cmd.exe
1800	cmd.exe
5276	cmd.exe
5504	cmd.exe
5364	cmd.exe
5316	cmd.exe
4884	cmd.exe
4444	cmd.exe
5924	cmd.exe
5064	cmd.exe
3472	cmd.exe
4432	cmd.exe
5608	cmd.exe
2092	cmd.exe
5020	cmd.exe
3520	cmd.exe
3744	cmd.exe
5472	cmd.exe
4940	cmd.exe
5904	cmd.exe
1544	cmd.exe
4576	cmd.exe
3484	cmd.exe
5956	cmd.exe
4396	cmd.exe
2720	cmd.exe
3460	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	c53ae83986aff5bd0ddff8aec0e9aa669c.exe

System Time Discovery 1 TTPs 32 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4884	cmd.exe
5848	cmd.exe
732	SystemSettingsAdminFlows.exe
1216	SystemSettingsAdminFlows.exe
1420	cmd.exe
1924	SystemSettingsAdminFlows.exe
2500	SystemSettingsAdminFlows.exe
2572	SystemSettingsAdminFlows.exe
5908	cmd.exe
1260	cmd.exe
1948	SystemSettingsAdminFlows.exe
3952	SystemSettingsAdminFlows.exe
6016	SystemSettingsAdminFlows.exe
5148	SystemSettingsAdminFlows.exe
1796	cmd.exe
4208	SystemSettingsAdminFlows.exe
4944	SystemSettingsAdminFlows.exe
1164	cmd.exe
4820	SystemSettingsAdminFlows.exe
6064	cmd.exe
5748	SystemSettingsAdminFlows.exe
3708	cmd.exe
6004	cmd.exe
2408	cmd.exe
5672	cmd.exe
4076	cmd.exe
904	SystemSettingsAdminFlows.exe
3092	cmd.exe
3992	SystemSettingsAdminFlows.exe
4088	SystemSettingsAdminFlows.exe
4264	cmd.exe
4268	cmd.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
368	taskkill.exe
4500	taskkill.exe
1756	taskkill.exe
4940	taskkill.exe
3228	taskkill.exe
4120	taskkill.exe
968	taskkill.exe
5908	taskkill.exe
5500	taskkill.exe
5376	taskkill.exe
1096	taskkill.exe
2008	taskkill.exe
1260	taskkill.exe
5116	taskkill.exe
2060	taskkill.exe
2060	taskkill.exe
2836	taskkill.exe
5020	taskkill.exe
6072	taskkill.exe
2372	taskkill.exe
1700	taskkill.exe
5888	taskkill.exe
3540	taskkill.exe
5304	taskkill.exe
4748	taskkill.exe
1436	taskkill.exe
5804	taskkill.exe
3832	taskkill.exe
1552	taskkill.exe
4464	taskkill.exe
5984	taskkill.exe
4460	taskkill.exe
5328	taskkill.exe
1180	taskkill.exe
2244	taskkill.exe
2752	taskkill.exe
552	taskkill.exe
4612	taskkill.exe
904	taskkill.exe
4768	taskkill.exe
4196	taskkill.exe
2148	taskkill.exe
4396	taskkill.exe
4184	taskkill.exe
6104	taskkill.exe
5484	taskkill.exe
1244	taskkill.exe
4512	taskkill.exe
3748	taskkill.exe
2008	taskkill.exe
4724	taskkill.exe
3356	taskkill.exe
1264	taskkill.exe
452	taskkill.exe
3560	taskkill.exe
3404	taskkill.exe
3388	taskkill.exe
1776	taskkill.exe
3228	taskkill.exe
740	taskkill.exe
4552	taskkill.exe
5616	taskkill.exe
4696	taskkill.exe
5076	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5168	taskkill.exe
Token: SeDebugPrivilege	1224	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	1616	taskkill.exe
Token: SeDebugPrivilege	5780	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	552	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	3708	taskkill.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	368	taskkill.exe
Token: SeDebugPrivilege	2748	taskkill.exe
Token: SeDebugPrivilege	1880	taskkill.exe
Token: SeDebugPrivilege	888	taskkill.exe
Token: SeDebugPrivilege	2060	taskkill.exe
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	2916	taskkill.exe
Token: SeDebugPrivilege	4228	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	684	taskkill.exe
Token: SeDebugPrivilege	4508	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	5848	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	2836	taskkill.exe
Token: SeDebugPrivilege	4500	taskkill.exe
Token: SeDebugPrivilege	2148	taskkill.exe
Token: SeDebugPrivilege	5012	taskkill.exe
Token: SeDebugPrivilege	4640	taskkill.exe
Token: SeDebugPrivilege	4772	taskkill.exe
Token: SeDebugPrivilege	4748	taskkill.exe
Token: SeDebugPrivilege	3580	taskkill.exe
Token: SeDebugPrivilege	2544	taskkill.exe
Token: SeDebugPrivilege	2112	taskkill.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeDebugPrivilege	452	taskkill.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	5500	taskkill.exe
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	5328	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	3560	taskkill.exe
Token: SeDebugPrivilege	5304	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	392	taskkill.exe
Token: SeDebugPrivilege	2240	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	3404	taskkill.exe
Token: SeDebugPrivilege	5376	taskkill.exe
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	3980	taskkill.exe
Token: SeDebugPrivilege	4940	taskkill.exe
Token: SeDebugPrivilege	5804	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3092	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	88
PID 2108 wrote to memory of 2488	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	90
PID 3092 wrote to memory of 6016	3092	cmd.exe	91
PID 2488 wrote to memory of 3360	2488	cmd.exe	92
PID 2108 wrote to memory of 3960	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	93
PID 2108 wrote to memory of 6028	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	94
PID 3960 wrote to memory of 5168	3960	cmd.exe	95
PID 2108 wrote to memory of 1652	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	96
PID 1652 wrote to memory of 1224	1652	cmd.exe	97
PID 2108 wrote to memory of 3136	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	98
PID 3136 wrote to memory of 1260	3136	cmd.exe	99
PID 2108 wrote to memory of 3996	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	102
PID 3996 wrote to memory of 1264	3996	cmd.exe	103
PID 2108 wrote to memory of 5868	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	105
PID 5868 wrote to memory of 1616	5868	cmd.exe	106
PID 2108 wrote to memory of 4888	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	107
PID 4888 wrote to memory of 5780	4888	cmd.exe	108
PID 2108 wrote to memory of 2100	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	109
PID 2100 wrote to memory of 4700	2100	cmd.exe	110
PID 2108 wrote to memory of 5408	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	111
PID 5408 wrote to memory of 552	5408	cmd.exe	112
PID 2108 wrote to memory of 2220	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	113
PID 2220 wrote to memory of 4976	2220	cmd.exe	114
PID 2108 wrote to memory of 4496	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	115
PID 4496 wrote to memory of 1036	4496	cmd.exe	116
PID 2108 wrote to memory of 5140	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	117
PID 5140 wrote to memory of 1776	5140	cmd.exe	118
PID 2108 wrote to memory of 4068	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	119
PID 4068 wrote to memory of 5028	4068	cmd.exe	120
PID 2108 wrote to memory of 3632	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	121
PID 3632 wrote to memory of 4868	3632	cmd.exe	122
PID 2108 wrote to memory of 5108	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	123
PID 5108 wrote to memory of 3696	5108	cmd.exe	124
PID 2108 wrote to memory of 4008	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	125
PID 4008 wrote to memory of 2500	4008	cmd.exe	126
PID 2108 wrote to memory of 4332	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	127
PID 4332 wrote to memory of 560	4332	cmd.exe	128
PID 2108 wrote to memory of 1164	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	129
PID 1164 wrote to memory of 5148	1164	cmd.exe	130
PID 2108 wrote to memory of 2288	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	131
PID 2288 wrote to memory of 1244	2288	cmd.exe	132
PID 2108 wrote to memory of 2988	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	133
PID 2988 wrote to memory of 4176	2988	cmd.exe	134
PID 2108 wrote to memory of 4092	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	135
PID 4092 wrote to memory of 2092	4092	cmd.exe	136
PID 2108 wrote to memory of 5688	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	137
PID 5688 wrote to memory of 5376	5688	cmd.exe	138
PID 2108 wrote to memory of 1544	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	139
PID 1544 wrote to memory of 3708	1544	cmd.exe	140
PID 2108 wrote to memory of 5380	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	141
PID 5380 wrote to memory of 5908	5380	cmd.exe	142
PID 2108 wrote to memory of 224	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	143
PID 224 wrote to memory of 368	224	cmd.exe	144
PID 2108 wrote to memory of 4852	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	145
PID 4852 wrote to memory of 2748	4852	cmd.exe	146
PID 2108 wrote to memory of 5052	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	147
PID 5052 wrote to memory of 1880	5052	cmd.exe	148
PID 2108 wrote to memory of 5432	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	149
PID 5432 wrote to memory of 4820	5432	cmd.exe	238
PID 2108 wrote to memory of 3804	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	151
PID 3804 wrote to memory of 5228	3804	cmd.exe	152
PID 2108 wrote to memory of 5364	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	153
PID 5364 wrote to memory of 2812	5364	cmd.exe	154
PID 2108 wrote to memory of 5156	2108	c53ae83986aff5bd0ddff8aec0e9aa669c.exe	155

C:\Users\Admin\AppData\Local\Temp\c53ae83986aff5bd0ddff8aec0e9aa669c.exe
"C:\Users\Admin\AppData\Local\Temp\c53ae83986aff5bd0ddff8aec0e9aa669c.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c arp -a
  2⤵
  - Network Service Discovery
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c @RD /S /Q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE >nul 2>&1
  2⤵
  PID:6028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5364
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5156
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:2080
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:1564
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:3988
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:2408
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1364
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5800
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:6012
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:656
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5064
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1952
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c @RD /S /Q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE >nul 2>&1
  2⤵
  PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4320
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4596
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5860
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:5960
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:6124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2228
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5316
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:2904
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:3532
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:2344
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5244
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:1260
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4432
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3372
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5712
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3064
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2772
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2476
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3116
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4716
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:4252
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:2820
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:5404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:4372
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:216
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:756
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:4192
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:6084
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:5672
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:6112
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3628
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1748
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3520
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:972
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3772
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4224
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4196
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3744
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4228
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:2636
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:4616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:6000
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:976
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4692
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:4032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:5668
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2720
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:4268
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1632
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3968
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5752
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2832
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3524
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5972
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:772
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5676
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5680
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:5160
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:3192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:3304
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:2116
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:2044
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5700
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:2968
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:1932
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:4868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:6064
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4968
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5012
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:640
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4816
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4960
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2196
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1052
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4992
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3428
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:2640
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:2084
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:4132
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:5816
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:4152
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:5412
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:4884
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5704
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:868
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2916
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5260
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:6108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3908
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4276
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4560
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:6016
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4104
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:5604
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:5384
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:5036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:3300
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3460
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:376
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1964
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:2336
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:5848
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5304
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5460
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5472
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1676
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5024
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3068
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3916
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5336
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2744
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:2704
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:4176
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:3196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:1392
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:2224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:5172
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:5376
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:540
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:1384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:368
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:1796
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4940
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3580
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5608
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1192
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1172
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4396
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4284
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:4572
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4576
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:4628
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:2104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1688
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5576
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:6028
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:5036
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:4264
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5372
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4900
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2448
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3048
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:6072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4932
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4948
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3232
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4524
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2348
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:628
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:2380
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2092
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:2768
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3484
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:1944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:3708
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2688
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1612
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:404
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5216
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1272
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4956
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1576
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:436
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    PID:1892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4444
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:4672
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:2296
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:936
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:2104
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3840
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5248
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:4864
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:4076
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1004
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4768
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1756
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1704
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2800
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2616
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2836
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5980
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2352
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:372
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:1592
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:5148
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:5040
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:3268
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:3440
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    - Launches sc.exe
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:5908
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:6024
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:3748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4280
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    PID:4028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1800
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5652
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1816
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4732
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4552
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4388
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:3132
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:6104
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:5892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5924
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:5480
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:2956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:2620
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:1980
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:2500
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - System Time Discovery
  PID:6004
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4700
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1572
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4976
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2752
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1664
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2992
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5568
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:364
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4868
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5276
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  PID:3880
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  PID:3196
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  PID:1188
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:5696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  PID:536
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  PID:4208
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:2748
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    PID:3980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3472
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SystemSettingsAdminFlows.exe SetInternetTime 1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Time Discovery
  PID:1420
- - C:\Windows\system32\SystemSettingsAdminFlows.exe
    SystemSettingsAdminFlows.exe SetInternetTime 1
    3⤵
    - System Time Discovery
    PID:904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>nul
  2⤵
  PID:3516
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:2544
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:3228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4260
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>nul
  2⤵
  PID:1732
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4696
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5308
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>nul
  2⤵
  PID:4032
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>nul
  2⤵
  PID:988
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T >nul 2>nul
  2⤵
  PID:5464
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq ida64*" /IM * /F /T
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5328
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerProSdk >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5956
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerProSdk
    3⤵
    - Launches sc.exe
    PID:1264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4944
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker3
    3⤵
    - Launches sc.exe
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker2
    3⤵
    - Launches sc.exe
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5504
- - C:\Windows\system32\sc.exe
    sc stop KProcessHacker1
    3⤵
    - Launches sc.exe
    PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>nul
  2⤵
  PID:5016
- - C:\Windows\system32\sc.exe
    sc stop wireshark
    3⤵
    - Launches sc.exe
    PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>nul
  2⤵
  PID:2240
- - C:\Windows\system32\sc.exe
    sc stop npf
    3⤵
    PID:3356