Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 14:14
Behavioral task
behavioral1
Sample
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe
Resource
win10v2004-20231215-en
General
-
Target
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe
-
Size
1.1MB
-
MD5
cbd091cac452f86c94499f712c7fb79b
-
SHA1
01d48986d1edfdcca9c2585325f37888b2b3ec84
-
SHA256
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5
-
SHA512
25be58c4c490e209c1f0d43bd03e488833d44c6e00b65d84e4c2871bab5bd5415c6e2b4b8db2c03a3c6c7f8e63572b7c2372f002b17577bcc7ce9318bf71e17b
-
SSDEEP
24576:XBvcNWXatHPiAcShw1cLCY0NH1LxLv8cGBVrXF5QecdGPyGLAB:xvcDtjpMHNJt8cwdFO2adB
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\ReadMe.txt
https://t.me/secles1bot
http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion
Signatures
-
Clears Windows event logs 1 TTPs 64 IoCs
Processes:
wevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exepid process 10144 wevtutil.exe 13760 wevtutil.exe 23072 wevtutil.exe 5912 wevtutil.exe 5884 wevtutil.exe 9996 wevtutil.exe 9720 wevtutil.exe 9988 wevtutil.exe 14112 wevtutil.exe 5748 wevtutil.exe 10008 wevtutil.exe 14084 wevtutil.exe 16352 wevtutil.exe 31396 wevtutil.exe 14092 wevtutil.exe 16800 wevtutil.exe 21856 wevtutil.exe 6128 wevtutil.exe 10236 wevtutil.exe 9904 wevtutil.exe 9980 wevtutil.exe 13960 wevtutil.exe 26900 wevtutil.exe 31612 wevtutil.exe 5948 wevtutil.exe 10176 wevtutil.exe 9712 wevtutil.exe 13924 wevtutil.exe 5960 wevtutil.exe 10108 wevtutil.exe 13860 wevtutil.exe 15788 wevtutil.exe 24112 wevtutil.exe 28604 wevtutil.exe 5720 wevtutil.exe 16168 wevtutil.exe 21232 wevtutil.exe 29648 wevtutil.exe 31212 wevtutil.exe 6008 wevtutil.exe 5744 wevtutil.exe 21680 wevtutil.exe 28036 wevtutil.exe 27788 wevtutil.exe 28228 wevtutil.exe 29020 wevtutil.exe 9840 wevtutil.exe 9840 wevtutil.exe 21032 wevtutil.exe 5844 wevtutil.exe 5620 wevtutil.exe 9748 wevtutil.exe 10104 wevtutil.exe 23388 wevtutil.exe 27104 wevtutil.exe 5808 wevtutil.exe 9720 wevtutil.exe 10176 wevtutil.exe 14092 wevtutil.exe 13792 wevtutil.exe 21280 wevtutil.exe 31656 wevtutil.exe 21092 wevtutil.exe 22860 wevtutil.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (9597) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Creates new service(s) 1 TTPs
-
Processes:
wbadmin.exepid process 56856 wbadmin.exe -
Drops file in Drivers directory 29 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\de-DE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\etc\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\es-ES\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\it-IT\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\es-ES\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\it-IT\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\ja-JP\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\drivers\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\drivers\UMDF\ja-JP\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Stops running service(s) 3 TTPs
-
Drops startup file 2 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Executes dropped EXE 1 IoCs
Processes:
sdelete.exepid process 57676 sdelete.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2416-0-0x000000013FF70000-0x000000014025D000-memory.dmp upx behavioral1/memory/2416-1-0x000000013FF70000-0x000000014025D000-memory.dmp upx behavioral1/memory/2604-2-0x000000013FEE0000-0x00000001401CD000-memory.dmp upx behavioral1/memory/2604-1457-0x000000013FEE0000-0x00000001401CD000-memory.dmp upx behavioral1/memory/2604-9839-0x000000013FEE0000-0x00000001401CD000-memory.dmp upx behavioral1/memory/2604-20155-0x000000013FEE0000-0x00000001401CD000-memory.dmp upx behavioral1/memory/2604-23277-0x000000013FEE0000-0x00000001401CD000-memory.dmp upx behavioral1/memory/2604-28239-0x000000013FEE0000-0x00000001401CD000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exeexplorer.exeexplorer.exedescription ioc process File opened for modification C:\Users\Admin\Favorites\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JJ7YKCO8\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FW0P2MZH\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\27PKR52P\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Music\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification \??\f:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMDLW4SJ\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\0U93YK0N\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BP3UABCB\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini explorer.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process File opened (read-only) \??\D: 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened (read-only) \??\F: 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened (read-only) \??\f: 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened (read-only) \??\D: 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened (read-only) \??\F: 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened (read-only) \??\f: 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
Drops file in System32 directory 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnlx00x.inf_amd64_neutral_808baf4e08594a59\Amd64\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\es-ES\Licenses\eval\HomeBasicN\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Enterprise\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\DriverStore\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\Tasks\Microsoft\Windows\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\eval\HomeBasicN\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_neutral_2d4257afa2e35253\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\flpydisk.inf_amd64_neutral_f54222cc59267e1e\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Setup\ja-JP\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_neutral_256ad642985694b3\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\Amd64\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-international-core\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\it-IT\Licenses\OEM\Enterprise\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Dism\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterN\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\he-IL\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\Speech\Engines\SR\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\de-DE\Licenses\eval\Ultimate\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\de-DE\Licenses\eval\UltimateE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\eval\Starter\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\com\it-IT\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\da-DK\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\wbem\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_neutral_f77725472d91b1d1\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_neutral_de46607a02fe2552\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\migwiz\PostMigRes\Web\base_images\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Dism\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_neutral_8b1e6b55729c3283\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiabr00a.inf_amd64_neutral_6033065925bcc882\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\User Profile Service\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicN\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\com\de-DE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmelsa.inf_amd64_neutral_374f9d31af832d6b\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\Amd64\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\migration\WSMT\rras\dlmanifests\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-International-Core-DL\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\MUI\dispspec\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\WDI\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\Dism\ja-JP\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\it-IT\Licenses\OEM\UltimateE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\es-ES\Licenses\_Default\EnterpriseE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\Amd64\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\wfp\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremium\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\it-IT\Licenses\OEM\ProfessionalN\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_neutral_0feacd08cb9c7fe3\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-OfflineFiles-Core\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\XPSViewer\de-DE\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\SysWOW64\DriverStore\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Berlin 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado27.tlb 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new.png 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00092_.GIF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\TexturedBlue.css 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\header.gif 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21390_.GIF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\settings.css 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\REMOTE.CFG 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178348.JPG 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00705_.WMF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SlateBlue.css 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099168.JPG 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Windows Mail\it-IT\WinMail.exe.mui 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BANNER.DPV 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149407.WMF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\settings.css 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00170_.WMF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00042_.WMF 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Windows Journal\Templates\Music.jtp 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net_1.2.200.v20120807-0927.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Drops file in Windows directory 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-rpc-http_31bf3856ad364e35_6.1.7601.17514_none_a20056db9d9602b9\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-n..untimeapi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e723ff19128c5cbf\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-controls.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_536898fb05dc3230\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-netbt.resources_31bf3856ad364e35_6.1.7600.16385_es-es_50e29b775cdfdd3a\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-wmvsdk_31bf3856ad364e35_6.1.7601.17514_none_0ea5f72371a1658e\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-photoviewer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4e05625854e407a8\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-lpksetup.resources_31bf3856ad364e35_6.1.7600.16385_it-it_be93ac22d37c8051\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_custommarshalers_b03f5f7f11d50a3a_6.1.7601.17514_none_feee409b39e33eea\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..ilter-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_01f3199aae0b8674\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-nshhttp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ebf4640b630bad9e\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_prnky004.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7f40c439127c150d\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehskb_31bf3856ad364e35_6.1.7601.17514_none_a8a886f06bf01c83\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_51624d066d0b3e1c\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_6.1.7600.16385_none_3df12febe293ce5d\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-a..istant-ui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_646ed7a9f28f1f8f\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-tzutil.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7756b31feb2115a1\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_de-de_70320daf7f8730be\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_machine.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2daccc45d1e19aa2\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-help-presset.resources_31bf3856ad364e35_6.1.7600.16385_it-it_dbece82fcff98421\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..gement-vdsinterface_31bf3856ad364e35_6.1.7600.16385_none_014cf80238b3c4e6\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ocsetup.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fce58e916c46f4d6\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-t..nvservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_16c89b47657be627\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-w..-infrastructure-bsp_31bf3856ad364e35_6.1.7601.17514_none_ba5ac0f18b8dd799\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..providers.resources_31bf3856ad364e35_6.1.7601.17514_en-us_cf28c79b7f2b526b\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\Speech\Engines\SR\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-exfat_31bf3856ad364e35_6.1.7600.16385_none_b15bd0bb32dc99fb\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_be3e81707c8573d5\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..ment-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9cb6ed489832eb2c\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..iondriver.resources_31bf3856ad364e35_6.1.7601.17514_es-es_3248bad0c5b8e21b\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e0c803777a7cc698\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ec73c27891718e69\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_prnky006.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d1137faaac5c4b95\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ada67cdecd176d1d\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_it-it_1e4d6c8ff7baeac6\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-winsockautodialstub_31bf3856ad364e35_11.2.9600.16428_none_d281e45472d89236\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-netplwiz.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e262c39de60de516\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\msil_microsoft.build.tasks.v3.5.resources_b03f5f7f11d50a3a_6.1.7600.16385_it-it_e7430a5438421723\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c3672adaf7f9b591\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\inf\ASP.NET_4.0.30319\0000\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-api.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_36217007ae29eb9d\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\msil_system.speech.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9511f676e4656831\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\diagnostics\system\WindowsUpdate\en-US\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..providers.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f330eccf98fd26d\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-photobase_31bf3856ad364e35_6.1.7600.16385_none_9c7564b9b4af5e86\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\3d01d2b7bde19d91d70c4ff96eea3432\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iis-w3svc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_58d860520ac16b37\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_8.0.7601.17514_de-de_f27a1c0586ef9a07\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..lorer-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a95aead79562c80b\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft.ink_31bf3856ad364e35_6.1.7600.16385_none_e2ed1727ba090daa\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..nistrator.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1146fc2b53b7ff21\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-h..cpl-instrumentation_31bf3856ad364e35_6.1.7600.16385_none_66c9316112d46d02\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\diagnostics\system\Printer\fr-FR\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-scanprofiles.resources_31bf3856ad364e35_6.1.7600.16385_es-es_03fb4fbda19e0446\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_6.1.7600.16385_it-it_604f3aad45471576\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-r..sisengine.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ac7fa527e84ff8ad\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-capisp-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6ad715ac39a7f5d8\ReadMe.txt 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 2912 sc.exe 2276 sc.exe 2548 sc.exe 56736 sc.exe 2248 sc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2712 vssadmin.exe 56792 vssadmin.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = 4b0e5f29970a83d24273ba29a6b703b75c4ba623e9f5106c2a5e9eec246c9bb9 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 48c07432f4c468c67c190fa3d5c016a951045f4ab330ab902ee68487626ba904 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = cee4baa6b03454fbb96558c3d94f7c5968d814f9e710f19a96c35c49069b0afe 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\SessionHash = 26bafb964aeccb01f22ffe68622431feced1ded6b4a6106ca2a3dca68267a168 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = 043a79602b4f1ec42c1045c8b427766936b804685d7c62be5f03835ca5f5c149 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\SDelete 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = b375d307be2f94a58defd20f745a0d221815b753da3aff122fdc4b18f69c5799 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\SessionHash = 6d6dec32f7463fb8a3f3dfda014f88e341fe0f6f9f2c283474f4f74964359705 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700320000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFilesHash = c3e1f0fa6da7d96d85ec73526c3f73d9367b62fee22c14c1d01a633e5d4134e8 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 3bc5e26a46b06baf9f9c0f81447b6330f09ad16270c1946cfdad9d884176742f 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 3b36b2a7ced482caa6bb576186f108a773cdc767e1f6daff149abb4ea7a8f0cd 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700320000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700310000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e0064006100740000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 0253a7631c02ca603061211d8f4c5d6368faff7d74cd00670ea027be50e60c54 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\SessionHash = 1c61a7359d395fefed3e96986dab2b1bbaa5767d8b913774b7740fdd4571ad6e 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = 5b0c2ff953ba1604118a6735d6141bb6365307277b1180eb831357ae0f660b44 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00500072006f006700720061006d002000460069006c00650073005c0043006f006d006d006f006e002000460069006c00650073005c004d006900630072006f0073006f006600740020005300680061007200650064005c004f0046004600490043004500310034005c00430075006c00740075007200650073005c004f00460046004900430045002e004f004400460000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\Owner = 2c0a0000903c9480bd52da01 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = 38196e9568a65533b4ee07abc36140f58d903c91cf9dbeaa4d93eb2e372043db 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\RegFilesHash = a90b62d1c696fba27fac601810ff7fb252f74cc2b5ef55bcfcca68c72fdb8f29 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e0068007600650000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\SDelete 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\SessionHash = c033c51572bab8178d69de0310edba155077ac659a792285c5d76f6fa7df635f 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\Sequence = "1" 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\SDelete\EulaAccepted = "1" 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 54021a840e0d7ae1c47d602c85caa5f4686b55703b4f908be8e1359d14f8c043 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 59f1e27aa81a9e4fca1fb34a955e5ca294f31309ddc88c946ba1e302a239ca26 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700310000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00660061003800350036003800390039002d0038006600310062002d0031003100650065002d0061003700340062002d003700650064003900300036003100650039006300330039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\Sequence = "1" 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00660061003800350036003800390039002d0038006600310062002d0031003100650065002d0061003700340062002d003700650064003900300036003100650039006300330039007d002e0054004d002e0062006c00660000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e0068007600650000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 90dae7858caf03222887436d0764713bb8e7911b2c1bc4f09d8ada21b08d7d9a 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700320000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e0064006100740000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = 95208685d75632a2cce5a9f45905e460ac7a0cb7038681c2e0ff0385badc6acf 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\SessionHash = be8d30fabb3e8469edd53f0ffaa9c803163cf8463f1dfe6a004f05a8fd38531d 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 5638061faae1a034175ba5c78f173f639d2fab3a5687635aaa9e217117d1cae4 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 2c0a0000903c9480bd52da01 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\Owner = 2c0a0000903c9480bd52da01 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFilesHash = a0c40f5db8491dd31637dda618f3492a15c2811541075f6ff68bfa39b5e6f8fc 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 7cad69c3c4603fae6caba6240e4dd5d9f5be3c5c8458ee3d5a10665da3aea0e2 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\Owner = 2c0a0000903c9480bd52da01 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700310000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = e4d9d7dd55695e49a53b23190920ec2293f6e82304f1abb53db6bbee74f183b0 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = 42b60dd48feccad54dd67596772e03966221209b93890f6f48ee6a28538399c5 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\SessionHash = 579bc34e679d56d81392a352753c683f8e535b82293c09b1bf9ddd0bc82f64a3 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 32ae4e826bbafffa4284996c856e751ad3092720a608bfdc87624554e0f907c4 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = a205757353a74548f811b39742cafac8e74af83f4f99272662e69eae5e9818e3 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\SessionHash = ca9aaa5c4ea2744096c6e8c413929caaeb8e096c4e1c40a637f92f6ce5c4e5f1 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00660061003800350036003800390039002d0038006600310062002d0031003100650065002d0061003700340062002d003700650064003900300036003100650039006300330039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Modifies registry class 10 IoCs
Processes:
explorer.exeexplorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exepid process 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 20408 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exepowercfg.exewevtutil.exewevtutil.exevssvc.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exedescription pid process Token: SeDebugPrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeRestorePrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeBackupPrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeTakeOwnershipPrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeBackupPrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeAuditPrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeSecurityPrivilege 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe Token: SeShutdownPrivilege 2500 powercfg.exe Token: SeSecurityPrivilege 5628 wevtutil.exe Token: SeBackupPrivilege 5628 wevtutil.exe Token: SeSecurityPrivilege 5664 wevtutil.exe Token: SeBackupPrivilege 5664 wevtutil.exe Token: SeBackupPrivilege 5652 vssvc.exe Token: SeRestorePrivilege 5652 vssvc.exe Token: SeAuditPrivilege 5652 vssvc.exe Token: SeSecurityPrivilege 5700 wevtutil.exe Token: SeBackupPrivilege 5700 wevtutil.exe Token: SeSecurityPrivilege 5720 wevtutil.exe Token: SeBackupPrivilege 5720 wevtutil.exe Token: SeSecurityPrivilege 5764 wevtutil.exe Token: SeBackupPrivilege 5764 wevtutil.exe Token: SeSecurityPrivilege 5796 wevtutil.exe Token: SeBackupPrivilege 5796 wevtutil.exe Token: SeSecurityPrivilege 5812 wevtutil.exe Token: SeBackupPrivilege 5812 wevtutil.exe Token: SeSecurityPrivilege 5832 wevtutil.exe Token: SeBackupPrivilege 5832 wevtutil.exe Token: SeSecurityPrivilege 5844 wevtutil.exe Token: SeBackupPrivilege 5844 wevtutil.exe Token: SeSecurityPrivilege 5860 wevtutil.exe Token: SeBackupPrivilege 5860 wevtutil.exe Token: SeSecurityPrivilege 5880 wevtutil.exe Token: SeBackupPrivilege 5880 wevtutil.exe Token: SeSecurityPrivilege 5896 wevtutil.exe Token: SeBackupPrivilege 5896 wevtutil.exe Token: SeSecurityPrivilege 5908 wevtutil.exe Token: SeBackupPrivilege 5908 wevtutil.exe Token: SeSecurityPrivilege 5928 wevtutil.exe Token: SeBackupPrivilege 5928 wevtutil.exe Token: SeSecurityPrivilege 5948 wevtutil.exe Token: SeBackupPrivilege 5948 wevtutil.exe Token: SeSecurityPrivilege 6008 wevtutil.exe Token: SeBackupPrivilege 6008 wevtutil.exe Token: SeSecurityPrivilege 6024 wevtutil.exe Token: SeBackupPrivilege 6024 wevtutil.exe Token: SeSecurityPrivilege 6040 wevtutil.exe Token: SeBackupPrivilege 6040 wevtutil.exe Token: SeSecurityPrivilege 6072 wevtutil.exe Token: SeBackupPrivilege 6072 wevtutil.exe Token: SeSecurityPrivilege 6084 wevtutil.exe Token: SeBackupPrivilege 6084 wevtutil.exe Token: SeSecurityPrivilege 6096 wevtutil.exe Token: SeBackupPrivilege 6096 wevtutil.exe Token: SeSecurityPrivilege 6112 wevtutil.exe Token: SeBackupPrivilege 6112 wevtutil.exe Token: SeSecurityPrivilege 6128 wevtutil.exe Token: SeBackupPrivilege 6128 wevtutil.exe Token: SeSecurityPrivilege 2748 wevtutil.exe Token: SeBackupPrivilege 2748 wevtutil.exe Token: SeSecurityPrivilege 2460 wevtutil.exe Token: SeBackupPrivilege 2460 wevtutil.exe Token: SeSecurityPrivilege 2500 wevtutil.exe Token: SeBackupPrivilege 2500 wevtutil.exe Token: SeSecurityPrivilege 5660 wevtutil.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
Processes:
explorer.exeexplorer.exepid process 23028 explorer.exe 23028 explorer.exe 23028 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe -
Suspicious use of SendNotifyMessage 50 IoCs
Processes:
explorer.exeexplorer.exepid process 23028 explorer.exe 23028 explorer.exe 23028 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe 20408 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.execmd.execmd.execmd.exedescription pid process target process PID 2416 wrote to memory of 2248 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2248 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2248 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2912 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2912 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2912 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2276 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2276 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2276 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2548 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2548 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2416 wrote to memory of 2548 2416 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe sc.exe PID 2604 wrote to memory of 2720 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe cmd.exe PID 2604 wrote to memory of 2720 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe cmd.exe PID 2604 wrote to memory of 2720 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe cmd.exe PID 2604 wrote to memory of 2712 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe vssadmin.exe PID 2604 wrote to memory of 2712 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe vssadmin.exe PID 2604 wrote to memory of 2712 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe vssadmin.exe PID 2604 wrote to memory of 2724 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe cmd.exe PID 2604 wrote to memory of 2724 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe cmd.exe PID 2604 wrote to memory of 2724 2604 5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe cmd.exe PID 2724 wrote to memory of 2500 2724 cmd.exe powercfg.exe PID 2724 wrote to memory of 2500 2724 cmd.exe powercfg.exe PID 2724 wrote to memory of 2500 2724 cmd.exe powercfg.exe PID 2720 wrote to memory of 5620 2720 cmd.exe cmd.exe PID 2720 wrote to memory of 5620 2720 cmd.exe cmd.exe PID 2720 wrote to memory of 5620 2720 cmd.exe cmd.exe PID 5620 wrote to memory of 5628 5620 cmd.exe wevtutil.exe PID 5620 wrote to memory of 5628 5620 cmd.exe wevtutil.exe PID 5620 wrote to memory of 5628 5620 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5664 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5664 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5664 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5700 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5700 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5700 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5720 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5720 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5720 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5764 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5764 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5764 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5796 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5796 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5796 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5812 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5812 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5812 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5832 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5832 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5832 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5844 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5844 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5844 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5860 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5860 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5860 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5880 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5880 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5880 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5896 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5896 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5896 2720 cmd.exe wevtutil.exe PID 2720 wrote to memory of 5908 2720 cmd.exe wevtutil.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe"C:\Users\Admin\AppData\Local\Temp\5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\windows\system32\sc.exe"C:\windows\system32\sc.exe" create defser binpath= "C:\Users\Admin\AppData\Local\Temp\5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe" start= auto2⤵
- Launches sc.exe
PID:2248
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" delete defser2⤵
- Launches sc.exe
PID:2912
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" create defser binpath= "C:\Users\Admin\AppData\Local\Temp\5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe" start= auto2⤵
- Launches sc.exe
PID:2276
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" start defser2⤵
- Launches sc.exe
PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exeC:\Users\Admin\AppData\Local\Temp\5cf6d2669348a6d1652a6cc16734b8ad9d8684658da92236194a939542242df5.exe1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c c:\windows\logg.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil el3⤵
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\system32\wevtutil.exewevtutil el4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5628
-
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5664
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Application"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DebugChannel"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowFilterGraph"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowPluginControl"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Els_Hyphenation/Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "EndpointMapper"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5832
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "ForwardedEvents"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "HardwareEvents"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Internet"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Key"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5896
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationDeviceProxy"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Media"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationDeviceProxy"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPerformance"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPipeline"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPlatform"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IE/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IEDVTOOL/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IEFRAME/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-JSDumpHeap/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ADSI/Debug"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-API-Tracing/Operational"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/General"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"3⤵
- Clears Windows event logs
PID:5620
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ActionQueue/Analytic"3⤵PID:5664
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AltTab/Diagnostic"3⤵PID:5728
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppID/Operational"3⤵PID:1292
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/EXE"3⤵PID:5724
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/MSI"3⤵PID:5752
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5824
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"3⤵PID:5864
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"3⤵PID:5880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"3⤵PID:5888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"3⤵
- Clears Windows event logs
PID:5912
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"3⤵PID:5944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"3⤵PID:5928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"3⤵PID:5976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Operational"3⤵PID:5992
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Performance"3⤵
- Clears Windows event logs
PID:5960
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audit/Analytic"3⤵PID:5952
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication"3⤵PID:6016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AxInstallService/Log"3⤵PID:6008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Backup"3⤵PID:6024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Biometrics/Operational"3⤵PID:6056
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"3⤵PID:6072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"3⤵PID:6108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Analytic"3⤵PID:6116
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Operational"3⤵PID:6124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"3⤵PID:6128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCache/Operational"3⤵PID:2496
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"3⤵PID:2660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"3⤵PID:2756
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"3⤵PID:5628
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"3⤵PID:5660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CAPI2/Operational"3⤵PID:5620
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CDROM/Operational"3⤵PID:5748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/Analytic"3⤵
- Clears Windows event logs
PID:5720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COMRuntime/Tracing"3⤵PID:5768
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Calculator/Debug"3⤵PID:5752
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Calculator/Diagnostic"3⤵
- Clears Windows event logs
PID:5808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertPoleEng/Operational"3⤵PID:5840
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"3⤵PID:5848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"3⤵PID:5852
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CmiSetup/Analytic"3⤵PID:5844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"3⤵PID:5872
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"3⤵PID:2592
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ComDlg32/Analytic"3⤵PID:2572
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ComDlg32/Debug"3⤵PID:5912
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"3⤵PID:5944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"3⤵PID:5928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CredUI/Diagnostic"3⤵PID:5976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"3⤵PID:6032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"3⤵PID:6096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"3⤵PID:6112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DCLocator/Debug"3⤵PID:6132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DNS-Client/Operational"3⤵PID:2716
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DUI/Diagnostic"3⤵PID:2748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DUSER/Diagnostic"3⤵PID:2460
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXGI/Analytic"3⤵PID:2620
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXGI/Logging"3⤵PID:5624
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXP/Analytic"3⤵
- Clears Windows event logs
PID:5744
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"3⤵
- Clears Windows event logs
PID:5748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"3⤵PID:5720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"3⤵PID:5764
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deplorch/Analytic"3⤵PID:5796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSync/Analytic"3⤵PID:5816
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSync/Operational"3⤵PID:5824
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUx/Informational"3⤵PID:5836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUx/Performance"3⤵PID:5868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"3⤵
- Clears Windows event logs
PID:5884
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"3⤵PID:232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DhcpNap/Admin"3⤵PID:5616
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DhcpNap/Operational"3⤵PID:5908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"3⤵PID:9688
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"3⤵
- Clears Windows event logs
PID:9720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiagCpl/Debug"3⤵PID:9784
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"3⤵PID:9808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"3⤵PID:9836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"3⤵PID:9856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"3⤵PID:9884
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"3⤵PID:9904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"3⤵PID:9928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"3⤵PID:9940
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"3⤵PID:9956
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"3⤵PID:9972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"3⤵PID:9984
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"3⤵
- Clears Windows event logs
PID:9996
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"3⤵
- Clears Windows event logs
PID:10008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"3⤵PID:10020
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"3⤵PID:10032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"3⤵PID:10044
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"3⤵PID:10060
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"3⤵PID:10076
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"3⤵PID:10092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"3⤵
- Clears Windows event logs
PID:10108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"3⤵PID:10128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"3⤵
- Clears Windows event logs
PID:10144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"3⤵PID:10156
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"3⤵
- Clears Windows event logs
PID:10176
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"3⤵PID:10192
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"3⤵PID:10208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"3⤵PID:10224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"3⤵
- Clears Windows event logs
PID:10236
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D10/Analytic"3⤵PID:5908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"3⤵PID:5992
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/Analytic"3⤵PID:9712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/Logging"3⤵PID:9736
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"3⤵
- Clears Windows event logs
PID:9748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"3⤵
- Clears Windows event logs
PID:9720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectSound/Debug"3⤵PID:9780
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"3⤵PID:9800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectWrite/Tracing"3⤵PID:9808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Disk/Operational"3⤵
- Clears Windows event logs
PID:9840
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"3⤵PID:9868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"3⤵PID:9880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"3⤵PID:9884
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"3⤵PID:9916
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"3⤵
- Clears Windows event logs
PID:9904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"3⤵PID:9932
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Documents/Performance"3⤵PID:2504
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"3⤵PID:9940
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"3⤵
- Clears Windows event logs
PID:9980
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Performance"3⤵
- Clears Windows event logs
PID:9988
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxpTaskRingtone/Analytic"3⤵PID:10000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"3⤵PID:10016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EFS/Debug"3⤵PID:10028
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Analytic"3⤵PID:10036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Debug"3⤵PID:10052
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Operational"3⤵PID:10064
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"3⤵PID:10080
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventCollector/Debug"3⤵
- Clears Windows event logs
PID:10104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventCollector/Operational"3⤵PID:10116
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"3⤵PID:10136
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog/Analytic"3⤵PID:10152
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog/Debug"3⤵PID:10164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Analytic"3⤵PID:10172
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Debug"3⤵
- Clears Windows event logs
PID:10176
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Operational"3⤵PID:10204
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"3⤵PID:10212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"3⤵PID:2572
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Feedback-Service-TriggerProvider"3⤵PID:9696
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"3⤵PID:9708
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"3⤵PID:9716
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Folder"3⤵
- Clears Windows event logs
PID:9712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Forwarding/Debug"3⤵PID:9732
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Forwarding/Operational"3⤵PID:9748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GettingStarted/Diagnostic"3⤵
- Clears Windows event logs
PID:9840
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GroupPolicy/Operational"3⤵PID:9868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HAL/Debug"3⤵PID:13724
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenter/Debug"3⤵PID:13740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenter/Performance"3⤵PID:13752
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"3⤵PID:13764
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Help/Operational"3⤵PID:13780
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:13812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:13836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:13856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:13876
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:13888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup-ListenerService"3⤵PID:13900
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HotStart/Diagnostic"3⤵PID:13912
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HttpService/Trace"3⤵
- Clears Windows event logs
PID:13924
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IKE/Operational"3⤵PID:13936
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IKEDBG/Debug"3⤵PID:13948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPBusEnum/Tracing"3⤵PID:13960
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"3⤵PID:13972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"3⤵PID:13984
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-International/Operational"3⤵PID:14008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"3⤵PID:14024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"3⤵PID:14036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"3⤵PID:14052
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"3⤵PID:14072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"3⤵
- Clears Windows event logs
PID:14084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"3⤵PID:14096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"3⤵
- Clears Windows event logs
PID:14112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"3⤵PID:14292
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"3⤵PID:13972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-File/Analytic"3⤵PID:14152
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"3⤵
- Clears Windows event logs
PID:13760
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"3⤵PID:14152
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Diagnostic"3⤵PID:13880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"3⤵
- Clears Windows event logs
PID:14092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"3⤵PID:13776
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"3⤵PID:13968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"3⤵PID:14160
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"3⤵
- Clears Windows event logs
PID:13792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"3⤵PID:13996
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"3⤵PID:14304
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"3⤵
- Clears Windows event logs
PID:13960
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"3⤵PID:13996
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"3⤵
- Clears Windows event logs
PID:13860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"3⤵PID:14172
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"3⤵
- Clears Windows event logs
PID:14092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"3⤵PID:13800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"3⤵PID:14504
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Known"3⤵PID:15088
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-L2NA/Diagnostic"3⤵PID:13944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LDAP-Client/Debug"3⤵PID:14964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"3⤵PID:14012
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"3⤵PID:13928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"3⤵PID:14972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"3⤵PID:14272
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MCT/Operational"3⤵PID:13816
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"3⤵PID:15020
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"3⤵PID:18152
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"3⤵PID:16032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Admin"3⤵PID:17368
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Debug"3⤵PID:14652
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Diagnostic"3⤵
- Clears Windows event logs
PID:15788
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Admin"3⤵PID:16260
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Analytic"3⤵PID:17288
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Debug"3⤵PID:14008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Operational"3⤵PID:16328
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"3⤵PID:17140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"3⤵PID:17192
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"3⤵PID:18092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"3⤵
- Clears Windows event logs
PID:16168
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"3⤵PID:17340
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MobilityCenter/Performance"3⤵PID:15640
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NCSI/Analytic"3⤵
- Clears Windows event logs
PID:16352
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NCSI/Operational"3⤵PID:17328
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"3⤵PID:18752
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"3⤵PID:16468
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS/Diagnostic"3⤵PID:17684
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS/Operational"3⤵PID:13740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NTLM/Operational"3⤵PID:16328
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"3⤵PID:16920
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Narrator/Diagnostic"3⤵PID:17708
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetShell/Performance"3⤵PID:13976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"3⤵PID:15584
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkAccessProtection/Operational"3⤵PID:16716
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkAccessProtection/WHC"3⤵
- Clears Windows event logs
PID:16800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkLocationWizard/Operational"3⤵PID:17212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"3⤵PID:15388
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProfile/Operational"3⤵PID:16956
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"3⤵PID:18140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"3⤵PID:17080
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NlaSvc/Operational"3⤵PID:15400
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLEACC/Debug"3⤵PID:20400
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"3⤵PID:23036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-Machine/Diagnostic"3⤵PID:23132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"3⤵PID:23296
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Debug"3⤵PID:23484
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Operational"3⤵PID:21356
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"3⤵PID:21192
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OneX/Diagnostic"3⤵PID:21036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OobeLdr/Analytic"3⤵PID:22720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PCI/Diagnostic"3⤵PID:22104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ParentalControls/Operational"3⤵PID:23144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"3⤵PID:23336
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PeopleNearMe/Operational"3⤵PID:23444
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"3⤵PID:21144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"3⤵PID:22108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"3⤵PID:20472
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"3⤵
- Clears Windows event logs
PID:21280
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"3⤵PID:22436
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Analytic"3⤵PID:23040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Operational"3⤵
- Clears Windows event logs
PID:21856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"3⤵PID:21268
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Admin"3⤵PID:20948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Debug"3⤵PID:23096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Operational"3⤵PID:23204
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"3⤵PID:23384
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"3⤵PID:23504
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"3⤵PID:21340
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"3⤵PID:23044
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC/Debug"3⤵PID:22660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC/EEInfo"3⤵
- Clears Windows event logs
PID:21092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"3⤵
- Clears Windows event logs
PID:21032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoost/Operational"3⤵PID:22092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"3⤵PID:22416
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"3⤵
- Clears Windows event logs
PID:22860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Recovery/Operational"3⤵PID:22996
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"3⤵PID:21428
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteApp"3⤵PID:21072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"3⤵
- Clears Windows event logs
PID:23072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"3⤵PID:22240
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"3⤵PID:23180
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"3⤵PID:23280
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"3⤵PID:20412
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"3⤵PID:23504
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"3⤵PID:20428
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"3⤵PID:20404
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"3⤵PID:23516
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ResourcePublication/Tracing"3⤵PID:23548
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RestartManager/Operational"3⤵PID:20180
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Search-Core/Diagnostic"3⤵PID:20488
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"3⤵PID:20580
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"3⤵PID:21092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"3⤵PID:21324
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-IdentityListener/Operational"3⤵PID:21776
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP/Perf"3⤵PID:21280
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sens/Debug"3⤵PID:21804
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ServiceReportingApi/Debug"3⤵PID:22380
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Services-Svchost/Diagnostic"3⤵PID:21036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Services/Diagnostic"3⤵PID:22428
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Setup/Analytic"3⤵PID:22548
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupCl/Analytic"3⤵PID:22840
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupQueue/Analytic"3⤵PID:20540
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupUGC/Analytic"3⤵PID:14132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"3⤵PID:22984
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"3⤵PID:22956
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"3⤵PID:22960
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"3⤵PID:22988
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"3⤵PID:22992
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"3⤵PID:22860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/Diagnostic"3⤵PID:1788
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"3⤵PID:1560
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"3⤵PID:1800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Shwebsvc"3⤵PID:1548
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"3⤵PID:21500
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shsvcs/Diagnostic"3⤵PID:21208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sidebar/Diagnostic"3⤵
- Clears Windows event logs
PID:21680
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"3⤵PID:21948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Spell-Checking/Analytic"3⤵PID:23116
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SpellChecker/Analytic"3⤵PID:23252
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StickyNotes/Admin"3⤵PID:23352
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StickyNotes/Debug"3⤵
- Clears Windows event logs
PID:23388
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StickyNotes/Diagnostic"3⤵PID:20412
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StorDiag/Operational"3⤵PID:23504
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StorPort/Operational"3⤵PID:20428
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Subsys-Csr/Operational"3⤵PID:20472
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Subsys-SMSS/Operational"3⤵PID:21016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Superfetch/Main"3⤵PID:22404
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Superfetch/StoreLog"3⤵PID:22460
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sysprep/Analytic"3⤵PID:22580
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"3⤵
- Clears Windows event logs
PID:21232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TCPIP/Diagnostic"3⤵PID:21148
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msctf/Debug"3⤵PID:21584
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msctf/Diagnostic"3⤵PID:23108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msutb/Debug"3⤵PID:23128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msutb/Diagnostic"3⤵PID:23256
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TZUtil/Operational"3⤵PID:23120
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Debug"3⤵PID:23792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Diagnostic"3⤵PID:23880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Operational"3⤵
- Clears Windows event logs
PID:24112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskbarCPL/Diagnostic"3⤵PID:24128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"3⤵PID:24180
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"3⤵PID:24328
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"3⤵PID:24508
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"3⤵PID:24520
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"3⤵PID:24180
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"3⤵PID:23796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"3⤵PID:24768
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"3⤵
- Clears Windows event logs
PID:26900
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"3⤵PID:27324
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"3⤵PID:27644
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"3⤵PID:27192
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"3⤵PID:26604
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"3⤵PID:27400
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"3⤵PID:27828
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"3⤵PID:28336
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"3⤵PID:26720
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"3⤵PID:27108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"3⤵PID:27092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"3⤵PID:27844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"3⤵PID:27220
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"3⤵PID:27384
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"3⤵
- Clears Windows event logs
PID:27104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"3⤵PID:27792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"3⤵PID:28236
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"3⤵PID:28164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"3⤵PID:27416
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ThemeCPL/Diagnostic"3⤵PID:28148
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ThemeUI/Diagnostic"3⤵PID:28652
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TunnelDriver"3⤵PID:27116
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UAC-FileVirtualization/Operational"3⤵PID:27040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UAC/Operational"3⤵PID:28492
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAnimation/Diagnostic"3⤵PID:27040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAutomationCore/Debug"3⤵PID:27392
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAutomationCore/Diagnostic"3⤵PID:27968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAutomationCore/Perf"3⤵PID:28260
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIRibbon/Diagnostic"3⤵PID:26876
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-USB-USBHUB/Diagnostic"3⤵PID:27212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-USB-USBPORT/Diagnostic"3⤵PID:26700
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User"3⤵PID:27408
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User"3⤵PID:27380
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User"3⤵PID:27732
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User-Loader/Analytic"3⤵PID:28404
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserModePowerService/Diagnostic"3⤵PID:28536
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"3⤵
- Clears Windows event logs
PID:28036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/DeviceNotifications"3⤵PID:27848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/Performance"3⤵PID:27888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/SchedulerOperations"3⤵PID:27108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UxTheme/Diagnostic"3⤵PID:28084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VAN/Diagnostic"3⤵
- Clears Windows event logs
PID:28228
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VDRVROOT/Operational"3⤵PID:27368
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VHDMP/Operational"3⤵PID:26880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VWiFi/Diagnostic"3⤵PID:27804
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VolumeControl/Performance"3⤵PID:26948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"3⤵PID:28068
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WABSyncProvider/Analytic"3⤵PID:28096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"3⤵PID:27508
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WER-Diag/Operational"3⤵PID:27344
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WFP/Analytic"3⤵PID:28508
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WFP/Operational"3⤵PID:28332
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WLAN-AutoConfig/Operational"3⤵PID:28272
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"3⤵PID:27276
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"3⤵
- Clears Windows event logs
PID:28604
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMI-Activity/Trace"3⤵PID:28664
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPDMCCore/Diagnostic"3⤵PID:28608
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"3⤵PID:28184
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPDMCUI/Diagnostic"3⤵
- Clears Windows event logs
PID:27788
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"3⤵PID:26812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPNSSUI/Diagnostic"3⤵PID:27168
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"3⤵PID:27828
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-ClassInstaller/Operational"3⤵PID:28388
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"3⤵PID:28592
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"3⤵PID:26924
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"3⤵PID:27696
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WSC-SRV/Diagnostic"3⤵PID:28708
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WUSA/Debug"3⤵PID:28868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-MM-Events/Diagnostic"3⤵PID:28964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic"3⤵PID:29040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-SVC-Events/Diagnostic"3⤵PID:29128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-UI-Events/Diagnostic"3⤵PID:29200
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WebIO-NDF/Diagnostic"3⤵PID:29312
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WebIO/Diagnostic"3⤵PID:29580
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WebServices/Tracing"3⤵
- Clears Windows event logs
PID:29648
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Concurrency"3⤵PID:28892
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Power"3⤵
- Clears Windows event logs
PID:29020
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Render"3⤵PID:29160
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Tracing"3⤵PID:29288
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/UIPI"3⤵PID:29500
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinHTTP-NDF/Diagnostic"3⤵PID:29164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinHttp/Diagnostic"3⤵PID:29620
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinINet/Analytic"3⤵PID:29164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinRM/Analytic"3⤵PID:30144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinRM/Debug"3⤵PID:30212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinRM/Operational"3⤵PID:30300
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windeploy/Analytic"3⤵PID:30396
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:30632
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:30996
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:31072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:31144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:31224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:31284
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsBackup/ActionCenter"3⤵PID:31344
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsColorSystem/Debug"3⤵PID:31432
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsColorSystem/Operational"3⤵PID:31496
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsSystemAssessmentTool/Operational"3⤵PID:31552
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsSystemAssessmentTool/Tracing"3⤵PID:31616
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsUpdateClient/Operational"3⤵PID:31684
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wininit/Diagnostic"3⤵PID:30732
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winlogon/Diagnostic"3⤵PID:30880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winlogon/Operational"3⤵PID:31032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winsock-AFD/Operational"3⤵PID:31088
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winsock-WS2HELP/Operational"3⤵PID:31140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winsrv/Analytic"3⤵
- Clears Windows event logs
PID:31212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wired-AutoConfig/Diagnostic"3⤵PID:31276
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wired-AutoConfig/Operational"3⤵PID:31336
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wordpad/Admin"3⤵
- Clears Windows event logs
PID:31396
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wordpad/Debug"3⤵PID:31452
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wordpad/Diagnostic"3⤵PID:31512
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-mobsync/Diagnostic"3⤵PID:31564
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ntshrui"3⤵
- Clears Windows event logs
PID:31612
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-osk/Diagnostic"3⤵PID:31616
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-stobject/Diagnostic"3⤵PID:30772
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "OAlerts"3⤵PID:31032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Security"3⤵PID:31088
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Setup"3⤵PID:31140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "System"3⤵PID:31232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "TabletPC_InputPanel_Channel"3⤵PID:31440
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WINDOWS_MP4SDECD_CHANNEL"3⤵PID:31452
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WINDOWS_MSMPEG2VDEC_CHANNEL"3⤵PID:31576
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WINDOWS_WMPHOTO_CHANNEL"3⤵
- Clears Windows event logs
PID:31656
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WMPSetup"3⤵PID:31712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WMPSyncEngine"3⤵PID:31740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Windows"3⤵PID:30580
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin"3⤵PID:31048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "muxencode"3⤵PID:31116
-
-
-
\??\c:\Windows\system32\vssadmin.exe"c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2712
-
-
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\system32\powercfg.exepowercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" delete defser2⤵
- Launches sc.exe
PID:56736
-
-
\??\c:\Windows\system32\vssadmin.exe"c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:56792
-
-
\??\c:\windows\system32\wbadmin.exe"c:\windows\system32\wbadmin.exe" delete catalog -quiet2⤵
- Deletes backup catalog
PID:56856
-
-
\??\c:\Windows\System32\wbem\WMIC.exe"c:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:56308
-
-
\??\c:\Windows\System32\cmd.exe"c:\Windows\System32\cmd.exe" /c del /S /Q /F c:\windows\temp\2⤵PID:57656
-
-
\??\c:\windows\sdelete.exe"c:\windows\sdelete.exe" -nobanner -z f: c:2⤵
- Executes dropped EXE
PID:57676
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:23028
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:20408
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:56968
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:57168
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:57276
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
1Indicator Removal
4File Deletion
3Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
623B
MD504616f41849288a0d5a14de6922b1205
SHA194ddc283420e240132cb8be4c66c2fd6118b6cf8
SHA256cb28c999a7e2c45416fcda7cd9f08b7e59bcaebef9e614414238b625f01be26d
SHA5122a45026e70d84438f043389ba8844399c1d704004e10ed10ef8262ac1aa6ae309e027658a32ad210f097dc0f73a7e6c9f165cf5e43d57be11ff0a119ecaedd5c
-
Filesize
687B
MD556f0a23fe2f791b1e1812e4b0c576b5e
SHA130d9dbf308dbaf7200ccb3a8542202df84f420e5
SHA256f0294a21888d138594a5c69bb30eb8d176c04321b78025e5e15d1606fb9aa283
SHA512b7ccf4c36e6e29fffb52c9b902af68bca9c67f28452d5e046b8b25686cc0fe5bf1f492481207845f86130d503458fcac5fd62ce341c3fdda529404743033cab4
-
Filesize
601B
MD5e0120497e55d4bcb5e784bf843c38d21
SHA19628eda9d08e15387f471df6d726c7b36fb4d402
SHA256a3b2818028dd36c1ed14a12e5e5ea09f4dc22a3cbe45c07752120e3bc9f5224a
SHA512da00e8828542320bc6c93bf7841c80e2eec966716cd714852ad808a7866241c95a36bb4439a5fbd614ac94a1e789daf4c44e8b4595806fc807c765ed665d8a8f
-
Filesize
528B
MD57c56cbf65e268cfeb31b6cfabe6812c2
SHA1993aa7f73024bdf1dec0d04a13615b90e80bc453
SHA256b03f7cdf8c7257c73718365704b59320c4fde474f77d25bc8f35e70ffa230ad3
SHA512357a77f19b347f87b380ce91d3e002c3070a6abcb8ca8945c02c460f6fbbbdbfb6fe301078d2eef84cf4f932847f90c4f1b9ac2920415b035e54980544f7ce54
-
Filesize
601B
MD5896ab5dead58e3d7d2f923a91aaf114f
SHA13eb1a4331fa15e8a1ebd71fa52e757da68e8abe7
SHA256edb2bd7db8b4b7c9da35c1f2b9ad7d67060be2c70d573bfb775559e0e860c3cb
SHA5129a565c24508a63b8d419b664e21280a6941474c7c9ff4c6f224eacebbccd971e8b329d125f2ed2d531b20676db3db2ac2ddb18fe9f1766829a9ef4c320418710
-
Filesize
797B
MD5694a3f175221092d40a865dcf10753e8
SHA11e65a3ecda40371811cad8822cd22831edb376f8
SHA256af654a05cca2c703ffa678d45a537b3a353c3723a7d5560990f77633070a23f0
SHA5129ce93375b18bc8651a59b30572dd3f64254741bb958f34921330480e719c27927089b9d59c10965d08145a65f3e05d3c2782060c018e7d46d451b61e4ef213e0
-
Filesize
1KB
MD51ca010db13ba349d8b243bd31d0b0d07
SHA182a7e6b2075ceaa75d55ef6207767e17bd11fcee
SHA2565522941af366bcc3855455ee1154e105d67e7d41405e45e72e59bf3c46eb4a97
SHA512ceb549c5b058c3efba673443cf3249d1f93c1a005b98ec42e67f1633fec9f8997c78adde117a108593d4615740b64843914ca4b5d04f997baed84e605d26f5d3
-
Filesize
770B
MD5748eba250ad87e6deb528a7bd98469f3
SHA130ab3a839619089303cf307e16b41857ed84a380
SHA256a6453958ff6d24d7573af97c1a854b71d9057f44029fe26ba4139cb0f2939bc7
SHA5129deea60e022a5afc7a5b0aafc986698f6271f45ece5b53986547d4d970b52c1428d44ebe8669659440aa6dc8b02888975de3b2b96021408d006841c32e7a18b7
-
Filesize
643B
MD592f6deed2566f884741541ab1d464c7b
SHA167e2fe3dc4b38c64995f8aaa2f7f28e962dff6f6
SHA2565396ebd493b264d44968f04d23bf4f6585182eb8110138594ddd1370b2c4c47b
SHA512a0df41b9ae1863cf231c3663f91430a86362be79adfcf9a88cf998d31ec5c51c0630a50d4653ce2cc4c76105c60b8b04fc0d95587b50c90d35549608a9d866fb
-
Filesize
2KB
MD5def445683105cfb4ee336bd74a9d0712
SHA149a394783fc483279f0b7045b94c136c208b8322
SHA25657edd6fc088bca27d073634e0ada54184c161ff2d0eacabb15c3625b52c46589
SHA512bbafbc473ed91e1f1867cf24815105af77480159444f4bb3d89328ff4840c03ae191f8bc0df5bf9d2ae0cfbb11f4c45115a402d02ddc93a11746dabced27f688
-
Filesize
2KB
MD517db2ae30f6c1ce0eb8dfb6de7301a00
SHA194493557b2bf5e01b89f20886ba32dee5fc8f783
SHA25601ce68ffa2a87e0a004be8f3bdd49c14ff6b57c443d97808e3641afb8cdb682f
SHA512c9266181e2c99c3e4648c6039e4d928aa412baced320cf61d43e41c8717a123fd7897da3a991d7e77d20adb0c7e0ed204c64e47342e9c42ef4cfc87c3240872b
-
Filesize
1KB
MD5527579a024726687f07094c8239b9325
SHA1ea3aa59b91cb41541c134cc45f0b49ab307ba1cf
SHA256bfae3ec131bbf8b2ab52930e2a167a72f33162a4d50f1ffc378863d4e1413507
SHA512ce0fa2c68eb935af55e52cac83032e509d3cd62c568910eb0562f6ad6e9f71948b14a7aff37f5b5af0ad8fdf991b2d3b520c8c3bd4a3d0e41000baee5e07ff2e
-
Filesize
1KB
MD52b39c63b046ac0fa1389c16191d1613e
SHA1c86ad1649432fee99a1e4f4546f88d745f5240bf
SHA2567857e4ac902ff4ca3b5935e7e368ad779f47543f1a6a5dd5f63f45002bc90ed7
SHA512545d503660ed722229ee6270e4322160b8710d0d719d00643115e1b230ebe198ccfd6891d290f2118e01f358d4d0c461eb79e282fe1cbca4c711e86b5d380f5d
-
Filesize
601B
MD57cc8be6f152e7b7270c62be383dc3fc4
SHA1e67de5bf265a814b3062419badbeca8a14f6232f
SHA25616c0d5c5a14c55c7a7ff319c5005c38b4feaf6cf983bfc68f6c6b460fdf548b0
SHA512f6b80a579f88c3616176d7057eb35985354656dfbdcda8afb5a7bba80d5b6719fa08a12d89153c72084ae04fa44e83747f4c2a203d7498ce2f109667ff3e75a3
-
Filesize
1KB
MD53ccc71aa98e0dabe234a08386fc3e2ce
SHA1c157b06632aa427ed20cc482e777c3f056c6fb71
SHA256fc64e1743de57b8bffe9b908c992eaa992f3610425760b29651890aefa478d4f
SHA51279d3a03d77347ca0d930aeb59302113251131d91bffa6b297d2b9ac27620740d7d17c6ec15db15bd9c9ff5b59f40510ea3c3c3d6906bf96bf84e9be18848492f
-
Filesize
869B
MD52d197b8b749fbdbb1e9873a4b7353a02
SHA1c23fb362deefbf14b28654eb66c87b57700bc1f4
SHA2562802acabb35806581dc9b27f69ee86ffcfa962db93fabe2b808ed5f155ffe80f
SHA512b82eafc174d51bd055d7abec0cdf985c10de2024938a58313118a2a5666cceefb6c5d560bf19fd372d2add3be88d058c0dc72925bafed2ed50e8607d88e1c5ba
-
Filesize
21B
MD5ae5b870422a894681852149c70f30f81
SHA104f0b227483c14af01f7401cdf9658878e5edfe7
SHA2560658d38ddff34224da386c983352798cc4770351b7ce80879beb7b601adc26d8
SHA512d0ba1e149fd1b708890c4033f2015a3b3b273427984ef9ee462f697d7ce5186a102448bd282560fd2a0fe49f0f72a9408366b86f36979d0f54db373d38dde811
-
Filesize
764KB
MD55e1ad18cad26c2ea5203f4a62a972b31
SHA1ddb45704862b7fa7f354d984367244460a5448de
SHA2561dca7ced1a4d4524044bbd7606993e55e3086dd4f0930ad61caf80a298c07fdf
SHA5124e49c20e8468cfd7735e8e847d21835ed9adce81f0dfed3bbbe5cfb37a1b1a4d26b5b359b2b79d363bf7e7cad1e67cd02a9f5c14bb8119d23d42db2bc14b90d3
-
Filesize
601B
MD5fbe3eed068cf58a78e1b23e2a2891695
SHA14e73c73846410e3dc913a3fa17bd34a28087fdb9
SHA25695283c9ad14401410246ce410a474511c83b11e9bb27201a5bbd1174e039209b
SHA5124a781944dd0edd08ac1fd057fbe20b64805b47055e4f3a716ed7bfd5624cbff5f46a2e4c5c8de384968169b0b08266916d349ff729ff92997f185f7eb2397e32
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
Filesize
451B
MD5bc5c2bab7483469bb28e5badad9208bf
SHA1c550f5d1aeaf2a21e7612b6f7d0bb4ab6696e516
SHA2567719b2d4b42853c3787572be8ec6fe215c39a3ce655eb1c94c636054f7336422
SHA512ad43cbc16983aa340b8aa422da0ab49226ab72bcf468c53292a4d29a8b33f99854d2315114e2b751ed2730e6cc6bca98340a5f70b831b5e9999450191d2f57c0
-
Filesize
1.0MB
MD53587c7d9ebdd96a5f5a97e4cd635e849
SHA1af7e151277c58620a2326fe9d2b8120dac2118db
SHA256fd3841386833f0f3c1e97f69719865d9095c52eddab050b726eab1f98a884b24
SHA51297a61d55d2bb5363e019d71ab04d6097350050883dc0269af579fed3995fb3ec9c0e1cdda1bb626162986a2fb441c40e2e7c5d2617a505c125ced194acb1c5fa
-
Filesize
451B
MD54a769454678fbfe9871a2a6e269f23a2
SHA1bdc74536e2d6e50615ed0ae713378c5bf4f5ec6f
SHA2563112315d9534b1a919ad115849be42546e92b7d38bd369527ddab79b3cd88a16
SHA5129639c871656d11a83a35819926ae16a3861d99c8c4b3d2ebec1cfbe8cb89dbd046d853aeab2527ea7e08149f1b3a3da5b0a59bec4790eb9c56e66a92d5086125
-
Filesize
451B
MD5011b3ed711afa098c0eef2ec42880285
SHA1ab683bfa47a0ebfa0cf31fcc1aca27e901bc2f2a
SHA256953e9dc854347ebbed62753b1085aab92dc042788a542b34afe279f17b4a733e
SHA512d35fbf287d8af6f0856e06967fed630ae7647d972bcb675076f6554145fdc5174be5483726de90565ecb6c21cc65d17f46676d49b1cb96d7112f499096c32f14
-
Filesize
3KB
MD5776f4daaad8c55aa2b02e3d761bac4d4
SHA1f74d46f152e9a154ce2cc104dd882092d3406e51
SHA256b66af1265dca03431caebd3efe4492e15fd591e574efec54be47abd92998fb30
SHA5123a6acc1f0f4cd7e0dfe2073b8598196804b70da6fe340ef016bc33eaaa12f4cdc63135ee2c965ee9cb0f6146f9fcc44728a2d386b4fbf0a99c6300646827ebf5
-
Filesize
451B
MD5c75233214effe11c2f5762c02403b4f6
SHA1aac58403e77f0497678326d0ef510b19532f920a
SHA25661bb79fec01fd752aa40882b90b7ad3e03bad5946c505ab050684afdf6c08f4c
SHA512675b8e278364953472bfb5877262763664b3c099ffc789b564a5cadc0105a85b29cf6c6f0a0582c05a8368c98face1797034c2fb0eaddbc8f63f3c6efc327d60
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Filesize638B
MD5ea08a23042f4ed74f14abb2565bc11aa
SHA16e241961747f00d06dc66784537f7a11595ae552
SHA25684a8848db3f26925f3b7dfff7f3859f0c320db6831dbdd6c169857056fa8608b
SHA512eb7e27cbf799001dd51a56c39d2a66ec232256fe96d5fd0320aefce368ce9bb2e8e9a21a86eb128706af72571ed72221c66b5101e220fd744b9a913d26044930
-
Filesize
648B
MD5379d284328ca55e63a4b79dc0dce110d
SHA1314830dc52b4e4525ee89716c7251d4dfe6dd6c8
SHA256ac030a85861c551b76ba5330e704f3fe81b38c9c45b7fae5df415f47ee97324d
SHA5121cb5576be633161e0619abb1b8d266c85b89e0fc7163039f3cf66186219b6d061282c4f6bf0938a3cc4ca523bee21099b5d02e4b3215d8624794feffa9febe7a
-
Filesize
3KB
MD5fa2daac621b0d9915b4352bd10e00b8f
SHA1436dc54880715d732f063428f4d895b8f3dc2786
SHA256ea3aaa856875c6dae460f8d1b86c8b59010381b497356d87bdf9dac266e9be3b
SHA5121f0ce74ddfd90c986b970efbe988e2c23dc6bee9fe36fae359dd0d770f9a9bef4e5c932ca53fcdf907aaae00bc7a7ea01eec44e151cfa0beccc19472e348b9bf
-
Filesize
3KB
MD51a13699d0094a45536edfda680f71db9
SHA123d042b61a88fd6bf4c7024431a7348a7a2db624
SHA2560a9f977c860caf6d288dd59476614c871d5f0eb1a0f2742db31e9f6aec9081be
SHA512f9e8356acb2e15a0f507bd1430a3cbefb5c0d4ee728d865fb5524fcf6b16922409c2b8944e3e4865cf917b2b669a1b4fdb68b2f13c4f51ee4be3624d9670060c
-
Filesize
3KB
MD517de7ae77b6c35d8b36ef76f72f15f67
SHA1062169b5d758067f12823538fbd04a0c327da2e7
SHA256780530ce60f685fdd46147279ecfedc5feed243d63423c1f06c130874a5b644d
SHA5129ad6ce73237d171ac392ade888fff32504eed18c5b40192f3701f07386b052e683b60e24adbb08049ca8e758e2206ff25fa9de749a1c79a45153a7fb0e619da8
-
Filesize
701B
MD5127958d4c7ea897f9cbcb8347aaed3be
SHA1d7993f757120ba96ced45f1976d0d0739134a80b
SHA256af2a4c56f40599e443475704c1f7bd57e0fc7d948dda9a379ab7fc16dcffc067
SHA51225bffac3ad0543cc355f6c6d105c004543bb7c8c2e230161d0724e60d1f0f5bee33bc0d4fd74eea7eae861ae702fe94bb2f8be6d4af8b8649d072f9493fce6b7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\desktop.ini
Filesize1KB
MD5588b39572cef4734912fd6e812aabf0c
SHA15b84b0e2b3b0809362c72103dfe957f250033c8e
SHA25677144efc2f39e97b9f0adf0d60edfb5ce41b45145a53f365588a33053db841ed
SHA512a1f0d7564cd37d088cca6160c61e5d45d76320421d6ee986b91ce14f3041ae64d53bda896fd27ee2674341e2634b538057f0cd9c7e8a94cd2f144c3cc6b91d1e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini
Filesize1KB
MD55c2fa49d44800259b65fb52bc60ef28e
SHA186c184dc64e53ee21e7789d8a68e89aed1436f55
SHA256951a00057c698ad69ba3094214ba50711137269c836495d2517e2b6ae37eaac1
SHA512ab6b797a722bce8d5b6ac4aebe0b8301cda0c0c5f14392f5efb029fe1d065c6e5c33ac6726acc0ca9431a2d80f11a7354fe8e0f6641812307cc2b00f408b03a9
-
Filesize
1KB
MD57a4adb5fe3d1c843cdcb9cbd317c6569
SHA1c3cdfc513241a09c84f95b479a37af374449f5de
SHA25662037e48b405b7e76bfaf2e3e459e4f45e992ea55308302ffa02b8b345a80da5
SHA5128555b1b8b623a97c0762a4de62b900b29abcd8923da5d1101584dca188db416160fdcf64c8d67c6e76e952c2a991c06ceb4f81a16792cab083572609e7810a7e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Filesize601B
MD55890b0c752746c5b1ebaa1e84febe8d1
SHA18f023c86ab2cb887eb094a2e8d80c3195fe515d9
SHA2560ff242defa649957312d6609a85e5b777bc8f0e1f62e273ebd6a152942765979
SHA512397cb85edcc41727a3a02e139f1eee66fe79c89f9c5157572c925ded25e0b385eb081433f3c7f23c8d54dab68e0af3cc6340c0d11b5a36dd986450ad2dccac16
-
Filesize
745B
MD50880b480ac06e5e311e2a89bc4749b4e
SHA184b392bcc1218c05e0e2b737a07b84a6ba796501
SHA256853b9432bf30c0afaa9b9ac20eecf25947cffd51597d244c44db4069cf88bbbd
SHA5125c7060b3510c9a75d3f5dfa64eac791ed3faad6ae01b121dc928e856eae8ee11a5d462a6bf2d3eb44fbdcf6d8f7cb202d0c84f2b0e2e4eb873cf184c3f3ed47c
-
Filesize
601B
MD58edd4da67a144aec441db1a4b77fc093
SHA178309a2deb78cc1b9db95f25690e8abdba0e241d
SHA256ed3b1162c8a636c814630eab5eefeda1b753584de92b9e7e11a14d56de204689
SHA512275e771fca1f5ef1ec94ac37ba1a265aea5d3693f85d738986892e568b9e12650fcdb56456363e1ca8980f953b663a60d5c016a53affbb6d6037de70681853fe
-
Filesize
903B
MD5b20c6d7f952af62e7639b2b42794042a
SHA1094f0eca0662ed085d126132b6ff8c7b0e5f23cc
SHA256825c8ed4fcb9ca47ec62b13cd804e048c201ec7ae2b861fc163c1295aeb1c9d2
SHA512974f9c1d23d2dfbb099931c26e8746d778fc9b319060b7f82c7b2942e2aaeb34284c9956b711fd84aee40906284e2d6635808b58b8392b421759ad413ecfd54d
-
Filesize
601B
MD59eb6d508e589e10178c8957222a033bd
SHA1de6b32fe49bf3749196de9f6d9c4c0666f661326
SHA2563e532c031bece54d6c9eddc3548253808746d22c21614e973efc0f95faf8b108
SHA512d85a7e6ebf87f1f0a5ac6725eb73646fbdc2072eec93cb6b03ef78446eb5f8d662479b72bb77b2a62f7e12d6b587b558e04bda39a0a14932356661d6b2f283b7
-
Filesize
993KB
MD5b33f21b8464fc70e312d5964078c0eef
SHA167ec7e875b37086d64ceb54689d89760117c5670
SHA2560b71af37803983626866653b1bd5f62d858c102f062bf2926f656ce7818c4b0f
SHA5128d3c7b9719d215b0bfa1df4921bc8c92fcdb7b8361cbb71a853a4fbc4102644b0715161be2dac60bc3c38cc921014d69b9284e85d3c087504fb0a2a3932cd54a
-
Filesize
816KB
MD5c04f3faf824529ed370e4a6b26c43856
SHA17adc5398a62a2188a85a87fa25e875453ccb3ad5
SHA256985fab75e2f5025a857efa3cd9f5fcf01625c8a6da4e54b7210deec74f9ef2cb
SHA512978acae44b930d0e4b28c998db7911e69ca9b4aeb7163a05c12646f59a1cf28260ecaac64feb23059960e16c926b5c6be24077ff05e7d38d5f4710667097a3c8
-
Filesize
1.1MB
MD5292662dc0f2d38e349bb9ee394574217
SHA1a3fb4a57d15a5ffabf4b25b18a1993b14be608ee
SHA256fb1056264ad9540536270ae4581d691cd53a0f8cc1d7fd3018f04697320b5e31
SHA512a355b3b115aa623789599b65c7dfbfc1eafca401c79e8a145f64cafcf0e36426509d092500b77f70084e55321a7f78e06bc1d65b9830a7903a73a2696ec00179
-
Filesize
728KB
MD5f1b0fcb1bd0454288796f807432f7059
SHA129e6c854d81e1f5ca2b468f196736393e76cae81
SHA256d2a2b472a6d17a314b856580bacc9616e5e961d0d59cc76b0e1ce64c886ecb53
SHA51244a224eabfaebba50d688ebe904ae58aa70eb58136b3c0b226a6dbf7fa9ebce54c1e19a8e0b87ab00f483199a883ed3be5bfd2f84e08cd1a33bb0399eb066624
-
Filesize
1.3MB
MD53e67e0754800b02fd316397fd4bd04e2
SHA120f10b2f8b5fdf57e0af94c31f19944fa91da630
SHA256adfc3208ddd288469681ed047f14c6afdbbe8a038a0a56774297ff89eba5dd7a
SHA512efd8d977b4bd7d16d50d42cf5cb76110d8cf39cfd0c4f4fabde2e834f466724cfdf47faeece917a26e699207f82db86c3f6804f2f8f10520a170f20c4fa519eb
-
Filesize
463KB
MD596d7f8a0f4dd626dd36a1010ba856ee8
SHA109b5d0f026c5a0ed2817109968ab6ce2d7820842
SHA25637e18d21792cfe4f58199bb524e49e195266ad5f3fc513bfc77a52c7b220a8a2
SHA51209d3592e5db23a7f6509d9b28e76cace3ae93e81ebb492aae034d3ec9240f4b6b64991f9d88f4052bb69e1bb73241ca8f34c906c01f5ee1349692d49ee2049a0
-
Filesize
684KB
MD5d60ce6d64b4290cd22840b7935161e17
SHA1e1e4adc3587b84a9ca7c055840da9fc5e90529db
SHA256d6656886138e38ddf01c47072ed7ce2a86d7eec0ecd04fb672f1d28a8ce87518
SHA512896f8bdf552e4a6472b0898d6dcdf547a96274f1afadf1f8955256034c84dea60ea768954208e74f34a1f54fd10110b50f7997ec2a3ebde341e40d7ffc2ae935
-
Filesize
904KB
MD5f79a8b42ea543f885b32c0a25a660863
SHA192ca0ae9aace2ee967d9f68e93ec14dfe671749e
SHA25671a9f287ffbe67749c9e098b1889ce866f6864767a018553a922ac18b19bdcf7
SHA512701c37e3855889dff704f69664035ef7bff8243699256c3c09e7bb905a6bc4e7c08a66dec3aa1ed7e67440d2e2db49810664cc9425052247e75208f3cf15c290
-
Filesize
1.0MB
MD5d2b936f0f55f18c4f602ef82e90712cc
SHA1fa6d9da1c1c90240d61f7db53deb2ebb54291cb2
SHA256b0e1d2402b38d2574961f6dacae3a26a6c11800b8d129800bec1c5ce2479c7a6
SHA512032e5c3f72073d29a7ebcaceb1a86db01ff0fd0f211a0250e5ca2a3424131e8f6268f74aba181bc935fb759053281a44184eb4c067dee6913e6fbfd56bb31471
-
Filesize
948KB
MD5853c7b7c4a7802fce53efdf6310c36a3
SHA194f134c4bd3c24ae8864ae93aaafcf0bc10c35fb
SHA256ce2f6f18f01c40cd219f1757133551f74bbdea5e494ad15055ea772b27bc7b5a
SHA51223d80e37a0033713d0305407f472b257d75928153b2962100f881965eeda21a0c8228c3c4052fdb5323eae89a9dc6c715fe5d3b9b4222c41ffe7d392ff95f333
-
Filesize
1.2MB
MD5c97dc401a78c308781354c962212f47f
SHA1b2faef6345ae58fd2ef2ed5f71a20684595f7206
SHA256fc656ee9d08716f51d575f7da9d2682d2ca8ebd276449922e75639124fae580f
SHA512bc4a8715369a3c35de69a9e41b67e8593772e78dce8af6257b233b5ec2e4d173a55b7e4522f776664bc9e7d397d43cf1da4d0b6549a74cafabce828c55e5535e
-
Filesize
596KB
MD505630ce4941875f27ede06cf135945d2
SHA13df7a805da6c194d3f70aa7a53e4d515cbb2c092
SHA256ffc56d0ca7f884708ab90fe73205c1969b447bb18831afddbce3be5f74dbfc24
SHA5120e968536f61898e8d816266c86f321311405cbe5d2d346ba3fa4bfe5d85f1fc5bda59a0309d682969b394c2c59b6c6d84ea3312f567f6b4169611a3803d33ac6
-
Filesize
772KB
MD5513fb6bc9da17740d3c2dcfa235d2258
SHA16f47a8e49e73e004811217cb34dea0123129503d
SHA25641c0d4b7c2cfccebe37e679915b2c068956c01da2559b4a19a3dc1b473ba004c
SHA512173fddb23ad6209697b8fc4fb1cbfaaefcda63fdd51f05dd0bd5e8ebdd439ed6f76aa1a01dcc8bf67c0a32aa709ce9e69d92b9865601be2364e616b9c5b008ed
-
Filesize
551KB
MD53855a946bbcf27c4deabcf8aab3a1a98
SHA1fe723a0634502e17192d258f38bb0c26a220bde6
SHA2567a6e363de584f75181bbd8ce5a0ff8669ac760c4698576802fc53230d0e06da3
SHA512faff2dcbba3fef2128639f48a86e9e520d8fab133f35a52a29aeea581c92e5273eff6c8f5fd53f199f643f75c3ab58394d140e325e8e680fe1ac0437370c5168
-
Filesize
860KB
MD59cfa3f702d8357fd946949175f32e82e
SHA19974b81b8a41dd45c2014a0af579ed35efc6c2bc
SHA2567dd576591893e1cdc4922a3f963e41d9ae3cc72dddfcf13712c28e9dbbdfaae2
SHA5124c308fae838dc94fd7b74cafc6649c8d3d91a2954e1fa292c839aaeaf0a744eaafee90929cc79f77378b53c85bf672b459335fcc71b82d5cc70d3b9a40ba6226
-
Filesize
507KB
MD5a29281103ec21d6928aabaf9c531b937
SHA101c34cd5421d498ab56d733f8c84219e373e1bf3
SHA256458e2e8e8dab85389a4a2b79c7d55b114c3951c898c742e4470c949d2c9a7f2d
SHA512e6a9a1c38090e7b33103a87661fd71bf8ace8328bf214245a2184a1a677fb446de9b9093eb2b2e7f35717a2f046463eae88c329fc431fce2cb317f5808e232e5
-
Filesize
1.2MB
MD5f30febdb7d069d23d87afbf2fd5f61c6
SHA1b532611dae069e4c5232196484d0e51fb7e34ba9
SHA2561bf9ecdd007589a35c6df95e11ea9f6ed87f48b1ba414c4b191cb62f3ba7e061
SHA512a3dd0f247dbad59f34f58229a06c6d842ccf5b49afcb4dac74bda819fd490731671261476ad7c3660fb18b43427266f6e46fa1b520eefd8e823272490e841425
-
Filesize
709B
MD50c44eec70ca3551e602559ea6117c945
SHA1c9134a5b08de6c7c29454c8a6089746d83ae1518
SHA2561c5fd680a14ac01bcaec135f50e56e3c358c050faca2d11a0967be13c0d200ca
SHA512c01732897abff8bdac85079f40189b167aa1edc855e54003923bda3c79dfa735f9745877140bd6d13ecaa569dcf295d69bcb79f5f1d3fbd00992afc5dc1c9b95
-
Filesize
24KB
MD59f8011c6a00387d958c50f8311ed2b35
SHA163d321c5f8034194763cb231c9b54a917b66429a
SHA256408aa4a496ce01fa368a87caf751b8afa6130848927725c38d45abe97b7982a2
SHA512864b6d551f26e3b043fb0ef1af9b900a5cfdda693690651083a3a998465795f3005e7440cc987c25377d1a8baa213ae30db231a977841924daaa5f46ad93e8ba
-
Filesize
601B
MD581c35d9c516069ac31b1678e40574953
SHA1ffb1fafda73fc88d7bee8e9c860cdbbe1500203e
SHA2560365acffe3ec88ebe12ef3d0a6502fa3d4e69c2c6f464305fa4dc185751ad9c6
SHA512bfad17377cf7efacc85f389df5038ae2eaa464566c6a69066d74247a761df94c854b7c0c2238a0cadbd1e55d565eafc0bc7ec73083b690b10e9f17c67badc630
-
Filesize
601B
MD578950a866e0095f7f360a46ffc9e7e02
SHA133ad8b76f787f351d57fde21faf51290d29468f2
SHA25699a0a8b07e866f72c4180b2fa2f9a624841d58a50e03e66e9ddb318e2736676c
SHA512d37fc88488b11386885af42e22b0b97457c6b389bcfcda22f2a50ecee12ba2fb6d30b6ff6b7a169f5c8c861ace05239a6ff10b3a93ad06ef0024afa56ed5b63f
-
Filesize
601B
MD5fd282fb594a511fb31b6cdab7f9d4413
SHA1f4fafc685ebf0f82d044d3160967758079ded6be
SHA2564af5ee8ccfa79ccfd59a059c51a356fc847f3238e7cba1ca03286e5b04ad4871
SHA512ad105b41e5357db426be33b24522b0b9318546ce99d2345a2b065fa6572efde4fb99a0c82f02eb46b6becce1ac4317e5119164998212a9bd35ed14f3dba1375b
-
Filesize
1KB
MD56957e737dd92dcf7be0928d577e14255
SHA1b0f7fb240c5c2854d43671520123016c49fa25c9
SHA2569c4a0a8c3f5e6f802341e45ab0021cb5f2d5c96459ee046d9143a73e5cde6f39
SHA51220458c4aaf5149808cc2999e7bf35c1363cf4675bad5c55c17c0b8f341e0fa8347c4c4a99284db8aebf9722cb61b5ee06bde04f8f3f196a5fd71a6514c523a71
-
Filesize
687B
MD56d5ed0d93ef99284671a0018991e6485
SHA18e42b89ac2a6590c1622ca88a06d7e4563e70d37
SHA256a8105f99ce9415d8a6163399e35f41477e223f5dd9f4b626dbb4ea65dc0fb8ec
SHA512f358d39bf17ebff5bb360c3230b2a6326c1ab68ddc983b07e2a7441fda7a82733c915e9bc927aa40beaf8ad4e4bc404815ee88e9428b00076bf697bc68f3d54c
-
Filesize
2KB
MD5c80a09579dbb0c16749b53ace9a9b1e4
SHA1e1253d44dbefb53116ae596e88c4c47ce2634395
SHA256418b3f7f3822b0ebb27b18ebe423b162067ed8a615ae5c5151b0ff79f54f05ed
SHA512c2b2abfde18f35729adbbbc8147f49efd63961744cfb4ebbaddb2dda9438f1f44b3c4d35e0d513b7a6c3748f0de86f1719fbcaeed719ba663f0f004b05fd4ee6
-
Filesize
4KB
MD50e513dfd1e1be75d90ad1c2c3e8313b9
SHA12608bd92e84fba6d44a346b00a0277b294d2b9e5
SHA256886482157bbbe7dc932f27b27687d126970bbd4cc0c5fd8ad3d0a1d2041685ca
SHA5120aee13e38aba7a709cd088b421659fcf77d39eab2ab15c3359fce134566980b44ead56be4d6fe4356b1296e9c3eb6738517faddf13aa2e412b4c5450c4a7d2d9
-
Filesize
2KB
MD583b3f32b50eb9509a094f1996f431112
SHA116dadf4b4fd566536c4aef2f59f4ae438f443d84
SHA25633b778436cbe949fb6e60ec1907b57fdc45eba4f90bf9a684fbd0f5e3878cbe5
SHA51208cb44cf0e777345d8b7b7290ac96f49e6b853b34b8cd7da22bccd3b986e09d29481338bf84faed70294743f5611535d113c20f4e74d09956d608e379ff38c17
-
Filesize
312B
MD5e6c8c2478db0951579f8c86cf619ddc9
SHA1bcbbccecf612af71b6becf919d2477a5c60c2766
SHA256d3fbbfefbe353ad76dbc9ce640a97e8d149e925fcffd311efd7d70acbbe18430
SHA512bd702b4e946adc1408c32f569a16aa952357af7c076e9a611f1b73733cd6496b03a78e69354b8d1175d94adfd8cc7b468ab59e92042f71c00a8c7a7532c035b6
-
Filesize
50B
MD5837f9483a4d9fb834d75537beb1c9488
SHA17421df5e92fbd2ef04eac5ede4397e4b87a3b7c2
SHA256ec64e2a730d0e32ff61a98f34ffdda69ea172234f8f432b95766e38c0f898e2d
SHA51237aa585177f560cd8d7b60303e820a7fa08f1a73d5fb79a6bae1f2c14e11d0f2d573059eb4e5c4bccb5021b336531d1eb3076a357b75a02c56570585a271cc69