Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 22:39
Behavioral task
behavioral1
Sample
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe
Resource
win10v2004-20240412-en
General
-
Target
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe
-
Size
1.0MB
-
MD5
f5eca9408d0f7e66bf8686fc6f322dea
-
SHA1
c5d3cb9c5bf02dc74ace0b6b3dfbfc7460141a3a
-
SHA256
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130
-
SHA512
76c448b50f51ce829a3f6e7bd21503c8f0a1d0b60b8e0e8d2290543fbf489a77ea8729b3b8d1591a2ef0785ba3f8e3c18cd2f8448c8907d918e16e81e65bb333
-
SSDEEP
24576:5k/vonhpYZQMkZWPNNjZ/AQXwIsceV4+z8F0LdA9:5k/vohp6zhdZeVJnd8
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\ReadMe.txt
https://t.me/secles1bot
http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion
http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion.ly
Signatures
-
Clears Windows event logs 1 TTPs 64 IoCs
Processes:
wevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exepid process 10012 wevtutil.exe 9884 wevtutil.exe 10108 wevtutil.exe 10208 wevtutil.exe 10176 wevtutil.exe 10212 wevtutil.exe 10020 wevtutil.exe 9788 wevtutil.exe 9980 wevtutil.exe 13896 wevtutil.exe 5952 wevtutil.exe 5808 wevtutil.exe 13928 wevtutil.exe 14096 wevtutil.exe 14304 wevtutil.exe 5848 wevtutil.exe 6044 wevtutil.exe 13736 wevtutil.exe 9992 wevtutil.exe 13916 wevtutil.exe 5760 wevtutil.exe 14292 wevtutil.exe 6096 wevtutil.exe 10072 wevtutil.exe 5808 wevtutil.exe 9996 wevtutil.exe 2712 wevtutil.exe 10120 wevtutil.exe 5932 wevtutil.exe 10036 wevtutil.exe 14216 wevtutil.exe 6108 wevtutil.exe 9992 wevtutil.exe 10148 wevtutil.exe 14108 wevtutil.exe 5808 wevtutil.exe 14000 wevtutil.exe 14084 wevtutil.exe 13792 wevtutil.exe 5744 wevtutil.exe 10072 wevtutil.exe 13860 wevtutil.exe 13884 wevtutil.exe 9788 wevtutil.exe 9952 wevtutil.exe 6096 wevtutil.exe 9836 wevtutil.exe 10000 wevtutil.exe 9976 wevtutil.exe 9896 wevtutil.exe 10028 wevtutil.exe 5964 wevtutil.exe 5644 wevtutil.exe 14080 wevtutil.exe 5868 wevtutil.exe 5700 wevtutil.exe 10124 wevtutil.exe 13868 wevtutil.exe 2832 wevtutil.exe 9908 wevtutil.exe 9920 wevtutil.exe 5844 wevtutil.exe 5648 wevtutil.exe 9740 wevtutil.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-1-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2664-3-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2664-26-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/17728-38-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2664-2610-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2664-8370-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2664-19619-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/memory/2664-27730-0x000000013F080000-0x000000013F317000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Renames multiple (9633) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 15 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-0-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/2372-1-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/2664-3-0x000000013F080000-0x000000013F317000-memory.dmp UPX \??\c:\windows\taskmgr.exe UPX behavioral1/memory/6040-20-0x0000000000B60000-0x0000000000BA9000-memory.dmp UPX behavioral1/memory/6040-21-0x0000000000B60000-0x0000000000BA9000-memory.dmp UPX behavioral1/memory/5724-23-0x0000000000B60000-0x0000000000BA9000-memory.dmp UPX behavioral1/memory/5724-25-0x0000000000B60000-0x0000000000BA9000-memory.dmp UPX behavioral1/memory/2664-26-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/17728-27-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/17728-38-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/2664-2610-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/2664-8370-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/2664-19619-0x000000013F080000-0x000000013F317000-memory.dmp UPX behavioral1/memory/2664-27730-0x000000013F080000-0x000000013F317000-memory.dmp UPX -
Creates new service(s) 1 TTPs
-
Processes:
wbadmin.exepid process 59044 wbadmin.exe -
Drops file in Drivers directory 29 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Windows\System32\drivers\it-IT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\ja-JP\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\etc\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\es-ES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\it-IT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\fr-FR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\ja-JP\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\fr-FR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\de-DE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\de-DE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\es-ES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Stops running service(s) 3 TTPs
-
Drops startup file 2 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Executes dropped EXE 3 IoCs
Processes:
taskmgr.exetaskmgr.exesdelete.exepid process 6040 taskmgr.exe 5724 taskmgr.exe 58500 sdelete.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2372-0-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/2372-1-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/2664-3-0x000000013F080000-0x000000013F317000-memory.dmp upx \??\c:\windows\taskmgr.exe upx behavioral1/memory/6040-20-0x0000000000B60000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/6040-21-0x0000000000B60000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/5724-23-0x0000000000B60000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/5724-25-0x0000000000B60000-0x0000000000BA9000-memory.dmp upx behavioral1/memory/2664-26-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/17728-27-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/17728-38-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/2664-2610-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/2664-8370-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/2664-19619-0x000000013F080000-0x000000013F317000-memory.dmp upx behavioral1/memory/2664-27730-0x000000013F080000-0x000000013F317000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exeexplorer.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\FW0P2MZH\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini explorer.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini explorer.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Music\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\BP3UABCB\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\27PKR52P\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4XCMPANZ\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMDLW4SJ\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened (read-only) \??\F: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\f: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\D: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\F: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\f: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\D: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 333 checkip.dyndns.org -
Drops file in System32 directory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmdcm5.inf_amd64_neutral_0bb09f3e5a59f3a8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\MUI\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_neutral_988a34fc912eab54\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\wbem\xml\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\de-DE\Licenses\OEM\EnterpriseN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Ultimate\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ph3xibc4.inf_amd64_neutral_310871d800afa82a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\config\RegBack\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\de-DE\Licenses\eval\StarterE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\it-IT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\com\dmp\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netmyk00.inf_amd64_neutral_9c0c35afdddc16d2\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\Speech\Engines\SR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\ja-JP\Licenses\_Default\Enterprise\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\DriverStore\it-IT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\Amd64\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\FxsTmp\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\wdi\perftrack\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\de-DE\Licenses\OEM\HomeBasicN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{522f6bf6-ae20-0f66-d982-a746d010852a}\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\Printing_Admin_Scripts\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\eval\Ultimate\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\es-ES\Licenses\eval\Professional\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\it-IT\Licenses\eval\HomePremiumN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_neutral_3c11362fa327f5a4\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netvfx64.inf_amd64_neutral_194cb6d2ea3a486e\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\migration\WSMT\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\it-IT\Licenses\_Default\EnterpriseN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\0407\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\de-DE\Licenses\_Default\HomeBasic\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\es-ES\Licenses\eval\HomeBasicN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\spool\drivers\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\_Default\ProfessionalE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ph6xib64c1.inf_amd64_neutral_68c99681343e9b68\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\Amd64\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0008\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IasServer-MigPlugin\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-OfflineFiles-DL\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_neutral_0b11366838152a76\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\hpoa1sd.inf_amd64_neutral_caaa16c52c48f8ac\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\spool\SERVERS\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\DriverStore\FileRepository\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Starter\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\fr-FR\Licenses\_Default\StarterN\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\ja-JP\Licenses\eval\UltimateE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199423.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Windows NT\TableTextService\de-DE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\flyout.html 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\Wks9Pxy.cnv 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099170.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115875.GIF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0240157.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02116_.GIF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\localizedStrings.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212661.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR44F.GIF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02282_.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\PIXEL.ELM 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_spellcheck.gif 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\DVD Maker\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\services_discovery\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.DPV 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Games\More Games\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\IPMS.ICO 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.DPV 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Reference Assemblies\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLR.SAM 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\SKY.INF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00395_.WMF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Windows Journal\ja-JP\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Drops file in Windows directory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Windows\winsxs\msil_system.drawing.design.resources_b03f5f7f11d50a3a_6.1.7600.16385_es-es_59803ffb7d6caab7\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_wiaep003.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_95fedd6649ab4cac\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_prnky003.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea944001f038144\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pnphotplugui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1bc5e156f5ab4b1a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\Boot\PCAT\es-ES\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-864_31bf3856ad364e35_6.1.7600.16385_none_2addd390b4e226f5\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-u..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_203b5e1fb499032b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_netfx-microsoft.build.framework_b03f5f7f11d50a3a_6.1.7601.17514_none_4c9eab58e2f91183\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-c..dlinehelp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c0e9deb5728f81c\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-e..tvratings.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bc7d9cb0412f6dee\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..eparation.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a4406b39cde6900d\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_8.0.7600.16385_es-es_bef4845e69104da1\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_it-it_31f2bea73f8ae0c2\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-a..on-experience-tools_31bf3856ad364e35_6.1.7601.17514_none_fd44d6c4f3725fed\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-security-spp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4fcc12c061ad9631\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-help-fax.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c28e99a5c88031c4\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-n..icysnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e453f30ee111bf3b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_nfrd960.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_edddf3075437b606\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_prnle004.inf_31bf3856ad364e35_6.1.7600.16385_none_3c624bcdff41cce3\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_6.1.7601.17514_none_5e47617f33c574ac\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-directshow-capture_31bf3856ad364e35_6.1.7601.17514_none_bae08d1e7dcccf2a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-i..ional-codepage-1141_31bf3856ad364e35_6.1.7600.16385_none_217fb46b6be96118\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9939fbe389b36fb3\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..framework.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d452af97e9cfa8a4\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\msil_microsoft.web.management.iis.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a36e3a6951a22675\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..lorer-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ac3d42db86a13c2a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-deployment_31bf3856ad364e35_6.1.7600.16385_none_57e3e87206ff08ca\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..factory-safehandler_31bf3856ad364e35_6.1.7600.16385_none_b6ee269e7dc8e75a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_2c4681bca9722a49\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-qwave.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7657e81062b18289\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-x..ollmentui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c3a194a371438ae1\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-recover.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bf035cdfc3da4515\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-d..irectdraw.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fb3664969865ace4\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-adminkitbranding_31bf3856ad364e35_8.0.7601.17514_none_ed30b91fe51eb56b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_prnnr003.inf_31bf3856ad364e35_6.1.7600.16385_none_b9a40efcdf84f11b\Amd64\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-ie-htmlconverter_31bf3856ad364e35_8.0.7601.17514_none_87da61075c9f17a8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-deskperf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_aa273a8c3b1262cc\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-usbperf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_400430896ebc6956\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_server-help-chm.rsop.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bd2266545f7bc428\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-themeui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f9b473768786ff26\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sud.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e0710d123c5a8ac8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-capisp-dll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9eb6cf5f9e297233\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-win32k.resources_31bf3856ad364e35_6.1.7600.16385_it-it_36047842421a5a1b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\System\adff7dd9fe8e541775c46b6363401b22\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_prnlx006.inf_31bf3856ad364e35_6.1.7600.16385_none_49c754b42a8fc0a2\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_da-dk_5be70d73a8675c63\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.EnterpriseServices.resources\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-charmap.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4333e611117e6214\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wlanconnectionflow_31bf3856ad364e35_6.1.7600.16385_none_e629c73a8182aca5\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_roles_b03f5f7f11d50a3a_6.1.7600.16385_none_02a1a2d949085578\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..oldertool.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_11c81aefa707c6a1\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-tapiservice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_292f069d35f52edc\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7601.17514_it-it_f1e038bcc779a0df\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snmp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8cd68992779eaf94\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..-mcplayer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6fe5c5b77532879a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-taskmgr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d67dc559c08dab90\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..eprotocol.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fd4cc85296b4e888\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_server-help-chm.nfs_client.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7b8f9d4fb4488447\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-at.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b6f764f67440bab8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\ehome\wow\fr-FR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..-postboot.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f14cf0761833324b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-icacls.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2472be8da60e8d87\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\assembly\GAC_32\System.Data\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_bfb240270a830f20\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 1172 sc.exe 58980 sc.exe 3016 sc.exe 3068 sc.exe 2164 sc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 58988 vssadmin.exe 2500 vssadmin.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exesdelete.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e0068007600650000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 2263636dfae907c106f1a69318d5f4fb233b2e521ae2272ebd214bd8ed53011c 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00660061003800350036003800390039002d0038006600310062002d0031003100650065002d0061003700340062002d003700650064003900300036003100650039006300330039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 96ee5dbb54f38548e0869a7c9a2b2050ea138537cb1e40c5d619b8f76364ebb5 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00660061003800350036003800390039002d0038006600310062002d0031003100650065002d0061003700340062002d003700650064003900300036003100650039006300330039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\Owner = 680a000000a998f34e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 7e1c70cefbf7d8d184d417cef01b969c829dc7f5edcf19f95da21d98c6a6b68a 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700310000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = 88ba05f0a817d0e3ca42d9ecbba4c8924b2d7cf13a9c07ef0e288c5861ed1f19 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = dc674c1f62b543095e52741336e042464f97eaea6aa8ba2aefbdaa77d8ebb7b8 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFilesHash = c6da939cf7e48ab04e69a20e1a6c5481ec181c1110d8eda50fca3128f70458aa 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = 45168919c4f18557f4c4e9387f7910c6d512385a64f026162a5170ad311d8888 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\Owner = 680a000000a998f34e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00660061003800350036003800390039002d0038006600310062002d0031003100650065002d0061003700340062002d003700650064003900300036003100650039006300330039007d002e0054004d002e0062006c00660000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e0064006100740000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 5ebab65eec7b1036cfc3c1cd7c534c9b51eb88b54f09b792f40052d228962a0f 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\Owner = 680a000000a998f34e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = 1313fe285718db01712e357724dd5719d89846bc34f19a3ea1fd71d3662cc78d 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = b6b8ecfa9b3c7be2dbdbd270fef7c5cc027fa876ffb31a4c57032ca4024e51a0 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = 731bc7102d97499d5012d476536f8bc49d50a4e598eeee766345e2c19994e9a4 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\SessionHash = 3509df8979fd459abb915fd2bd95f2fd3a3694efb602c420a8ab6060ba77ef69 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 4427c4ccf51a10a94fb810256e78f43f182f56dd3eb82196ddbd27bf672d344d 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = e44b8231cd405a102637418c9d304b061975fb3c6cba1b2dd82edd5b52b10e9f 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00500072006f006700720061006d002000460069006c00650073005c0043006f006d006d006f006e002000460069006c00650073005c004d006900630072006f0073006f006600740020005300680061007200650064005c004f0046004600490043004500310034005c00430075006c00740075007200650073005c004f00460046004900430045002e004f004400460000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 02f9e7a469e257606f6d343642e1119f7eae98a7bd8e3a5d4d1e0a5f7afcbaae 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\SDelete\EulaAccepted = "1" sdelete.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 8f41ffaa65b8a540872b571a77ac2374e947bfd1955432b2fbf8fc59f39e4ef3 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\RegFilesHash = 1237ec58f3b5b4149239ccb8714e22ecad8627279d919b20f174dc2ab63927e4 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700320000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 8a8ac16ae4bed5538656f5998fb59e7e94816f54a75e035d150d0e8d53751fb0 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\SessionHash = d16c64a89f618d4487d2231d1ba2da37613262873b823bfb143b59f70d26be16 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 38a4714cd04157a6515feac53707f436a19467b7642b12137ae4385d56a6d732 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFilesHash = 4c2ccc9805eac8e25bb961fc803b59e50bfaad7079d07a7f1745b709120faeb0 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFilesHash = b8ee4d367de28c8f4c346cd80a571ea0ef39bd5e7bdf45284eef11cfa0bdea80 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\SDelete 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700320000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\SessionHash = 12f0bf892f231f3cfe0620067517dacb97d40d25fc0ec9ccc0c58c1d418a1c32 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = 86c3d3a49eb4aa5bb99857a3cddbe10c677ee038027a24310fc540987f260950 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700310000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0004\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 839df5626ef4d7bfa405d6c831f51afefe300068f7c9ebcdf9ce44f9e806824f 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash = 43ae95dda6dec36dec8372613661a167d76d14f34efe4eaa72d4eb950a84a53f 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\SDelete\EulaAccepted = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0003\RegFilesHash = 5ee52a2278f0f606730996c0f49041a66146b6959b92f0a708e89e024bc489df 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00530079007300740065006d00200056006f006c0075006d006500200049006e0066006f0072006d006100740069006f006e005c00530079007300630061006300680065002e006800760065002e004c004f004700310000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700320000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\SDelete sdelete.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\Owner = 680a000000a998f34e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0002\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0001\SessionHash = 6e45f87570795380bf21c4d87863db0ca41ab2652de6c3bf0095c9665fe6034b 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash = 1035815dbfb1b1fe3ae7be489fd20a4b77e7f4262ba98a2dfcec32e6384c6f03 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exetaskmgr.exepid process 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 6040 taskmgr.exe 6040 taskmgr.exe 6040 taskmgr.exe 6040 taskmgr.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 30216 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exepowercfg.exewevtutil.exewevtutil.exewevtutil.exevssvc.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exedescription pid process Token: SeDebugPrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeRestorePrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeBackupPrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeTakeOwnershipPrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeBackupPrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeAuditPrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeSecurityPrivilege 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeShutdownPrivilege 5692 powercfg.exe Token: SeSecurityPrivilege 5724 wevtutil.exe Token: SeBackupPrivilege 5724 wevtutil.exe Token: SeSecurityPrivilege 5736 wevtutil.exe Token: SeBackupPrivilege 5736 wevtutil.exe Token: SeSecurityPrivilege 5776 wevtutil.exe Token: SeBackupPrivilege 5776 wevtutil.exe Token: SeBackupPrivilege 5768 vssvc.exe Token: SeRestorePrivilege 5768 vssvc.exe Token: SeAuditPrivilege 5768 vssvc.exe Token: SeSecurityPrivilege 5836 wevtutil.exe Token: SeBackupPrivilege 5836 wevtutil.exe Token: SeSecurityPrivilege 5888 wevtutil.exe Token: SeBackupPrivilege 5888 wevtutil.exe Token: SeSecurityPrivilege 5908 wevtutil.exe Token: SeBackupPrivilege 5908 wevtutil.exe Token: SeSecurityPrivilege 5928 wevtutil.exe Token: SeBackupPrivilege 5928 wevtutil.exe Token: SeSecurityPrivilege 5944 wevtutil.exe Token: SeBackupPrivilege 5944 wevtutil.exe Token: SeSecurityPrivilege 5964 wevtutil.exe Token: SeBackupPrivilege 5964 wevtutil.exe Token: SeSecurityPrivilege 5976 wevtutil.exe Token: SeBackupPrivilege 5976 wevtutil.exe Token: SeSecurityPrivilege 6004 wevtutil.exe Token: SeBackupPrivilege 6004 wevtutil.exe Token: SeSecurityPrivilege 6016 wevtutil.exe Token: SeBackupPrivilege 6016 wevtutil.exe Token: SeSecurityPrivilege 6032 wevtutil.exe Token: SeBackupPrivilege 6032 wevtutil.exe Token: SeSecurityPrivilege 6080 wevtutil.exe Token: SeBackupPrivilege 6080 wevtutil.exe Token: SeSecurityPrivilege 6096 wevtutil.exe Token: SeBackupPrivilege 6096 wevtutil.exe Token: SeSecurityPrivilege 6108 wevtutil.exe Token: SeBackupPrivilege 6108 wevtutil.exe Token: SeSecurityPrivilege 6124 wevtutil.exe Token: SeBackupPrivilege 6124 wevtutil.exe Token: SeSecurityPrivilege 6136 wevtutil.exe Token: SeBackupPrivilege 6136 wevtutil.exe Token: SeSecurityPrivilege 2832 wevtutil.exe Token: SeBackupPrivilege 2832 wevtutil.exe Token: SeSecurityPrivilege 2588 wevtutil.exe Token: SeBackupPrivilege 2588 wevtutil.exe Token: SeSecurityPrivilege 5656 wevtutil.exe Token: SeBackupPrivilege 5656 wevtutil.exe Token: SeSecurityPrivilege 5692 wevtutil.exe Token: SeBackupPrivilege 5692 wevtutil.exe Token: SeSecurityPrivilege 5660 wevtutil.exe Token: SeBackupPrivilege 5660 wevtutil.exe Token: SeSecurityPrivilege 5728 wevtutil.exe Token: SeBackupPrivilege 5728 wevtutil.exe Token: SeSecurityPrivilege 5700 wevtutil.exe Token: SeBackupPrivilege 5700 wevtutil.exe Token: SeSecurityPrivilege 5740 wevtutil.exe Token: SeBackupPrivilege 5740 wevtutil.exe Token: SeSecurityPrivilege 5712 wevtutil.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
explorer.exepid process 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe -
Suspicious use of SendNotifyMessage 47 IoCs
Processes:
explorer.exepid process 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe 30216 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.execmd.execmd.execmd.exedescription pid process target process PID 2372 wrote to memory of 3016 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 3016 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 3016 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 3068 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 3068 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 3068 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 2164 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 2164 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 2164 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 1172 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 1172 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2372 wrote to memory of 1172 2372 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 2664 wrote to memory of 2764 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 2664 wrote to memory of 2764 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 2664 wrote to memory of 2764 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 2664 wrote to memory of 2500 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe vssadmin.exe PID 2664 wrote to memory of 2500 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe vssadmin.exe PID 2664 wrote to memory of 2500 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe vssadmin.exe PID 2664 wrote to memory of 2708 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 2664 wrote to memory of 2708 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 2664 wrote to memory of 2708 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 2664 wrote to memory of 5644 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe schtasks.exe PID 2664 wrote to memory of 5644 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe schtasks.exe PID 2664 wrote to memory of 5644 2664 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe schtasks.exe PID 2708 wrote to memory of 5692 2708 cmd.exe powercfg.exe PID 2708 wrote to memory of 5692 2708 cmd.exe powercfg.exe PID 2708 wrote to memory of 5692 2708 cmd.exe powercfg.exe PID 2764 wrote to memory of 5700 2764 cmd.exe cmd.exe PID 2764 wrote to memory of 5700 2764 cmd.exe cmd.exe PID 2764 wrote to memory of 5700 2764 cmd.exe cmd.exe PID 5700 wrote to memory of 5724 5700 cmd.exe wevtutil.exe PID 5700 wrote to memory of 5724 5700 cmd.exe wevtutil.exe PID 5700 wrote to memory of 5724 5700 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5736 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5736 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5736 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5776 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5776 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5776 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5836 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5836 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5836 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5888 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5888 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5888 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5908 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5908 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5908 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5928 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5928 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5928 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5944 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5944 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5944 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5964 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5964 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5964 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5976 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5976 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 5976 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 6004 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 6004 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 6004 2764 cmd.exe wevtutil.exe PID 2764 wrote to memory of 6016 2764 cmd.exe wevtutil.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe"C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\windows\system32\sc.exe"C:\windows\system32\sc.exe" create defser binpath= "C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe" start= auto2⤵
- Launches sc.exe
PID:3016
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" delete defser2⤵
- Launches sc.exe
PID:3068
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" create defser binpath= "C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe" start= auto2⤵
- Launches sc.exe
PID:2164
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" start defser2⤵
- Launches sc.exe
PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exeC:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c c:\windows\logg.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil el3⤵
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Windows\system32\wevtutil.exewevtutil el4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5724
-
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Application"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5776
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DebugChannel"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowFilterGraph"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowPluginControl"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Els_Hyphenation/Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "EndpointMapper"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "ForwardedEvents"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:5964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "HardwareEvents"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Internet"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6004
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Key"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationDeviceProxy"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Media"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6080
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationDeviceProxy"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:6096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPerformance"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPipeline"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPlatform"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:6136
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IE/Diagnostic"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IEDVTOOL/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IEFRAME/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5656
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-JSDumpHeap/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5692
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5728
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ADSI/Debug"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-API-Tracing/Operational"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/General"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"3⤵PID:5796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ActionQueue/Analytic"3⤵
- Clears Windows event logs
PID:5848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AltTab/Diagnostic"3⤵
- Clears Windows event logs
PID:5808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppID/Operational"3⤵
- Clears Windows event logs
PID:5868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/EXE"3⤵PID:5904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/MSI"3⤵PID:5920
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5936
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5956
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵
- Clears Windows event logs
PID:5952
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:5964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"3⤵PID:6000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"3⤵PID:6004
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"3⤵PID:6016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"3⤵PID:6032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"3⤵PID:6064
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"3⤵PID:6068
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"3⤵PID:6096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Operational"3⤵PID:6112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Performance"3⤵PID:6124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audit/Analytic"3⤵PID:6136
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication"3⤵PID:2472
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AxInstallService/Log"3⤵PID:1888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Backup"3⤵PID:5688
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Biometrics/Operational"3⤵
- Clears Windows event logs
PID:2712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"3⤵PID:2748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"3⤵PID:5724
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Analytic"3⤵PID:5700
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Operational"3⤵PID:5736
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"3⤵PID:5712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCache/Operational"3⤵PID:5796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"3⤵PID:5848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"3⤵
- Clears Windows event logs
PID:5808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"3⤵
- Clears Windows event logs
PID:5844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"3⤵PID:5888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CAPI2/Operational"3⤵PID:5912
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CDROM/Operational"3⤵PID:5928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/Analytic"3⤵PID:5944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COMRuntime/Tracing"3⤵PID:5972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Calculator/Debug"3⤵PID:5980
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Calculator/Diagnostic"3⤵PID:5964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertPoleEng/Operational"3⤵PID:6000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"3⤵PID:6004
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"3⤵PID:6056
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CmiSetup/Analytic"3⤵PID:6048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"3⤵PID:6084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"3⤵PID:6104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ComDlg32/Analytic"3⤵PID:2600
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ComDlg32/Debug"3⤵PID:6096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"3⤵PID:6108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"3⤵PID:6140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CredUI/Diagnostic"3⤵PID:2624
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"3⤵PID:5716
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"3⤵PID:5636
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"3⤵PID:5656
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DCLocator/Debug"3⤵PID:5664
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DNS-Client/Operational"3⤵PID:5660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DUI/Diagnostic"3⤵
- Clears Windows event logs
PID:5744
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DUSER/Diagnostic"3⤵
- Clears Windows event logs
PID:5644
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXGI/Analytic"3⤵PID:208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXGI/Logging"3⤵PID:228
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXP/Analytic"3⤵PID:5856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"3⤵PID:5852
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"3⤵PID:5668
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"3⤵PID:2740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deplorch/Analytic"3⤵PID:5848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSync/Analytic"3⤵
- Clears Windows event logs
PID:5808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSync/Operational"3⤵PID:5844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUx/Informational"3⤵PID:5888
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUx/Performance"3⤵PID:5912
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"3⤵PID:5928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"3⤵PID:5944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DhcpNap/Admin"3⤵PID:5972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DhcpNap/Operational"3⤵PID:5980
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"3⤵PID:5964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"3⤵PID:6000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiagCpl/Debug"3⤵PID:6004
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"3⤵PID:6056
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"3⤵PID:6048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"3⤵PID:6084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"3⤵PID:6104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"3⤵PID:2600
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"3⤵
- Clears Windows event logs
PID:6096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"3⤵
- Clears Windows event logs
PID:6108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"3⤵PID:6140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"3⤵PID:2624
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"3⤵PID:5716
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"3⤵PID:5636
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"3⤵PID:5656
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"3⤵PID:5664
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"3⤵PID:5660
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"3⤵
- Clears Windows event logs
PID:6044
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"3⤵PID:6072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"3⤵PID:6040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"3⤵PID:5712
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"3⤵PID:224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"3⤵
- Clears Windows event logs
PID:5700
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"3⤵
- Clears Windows event logs
PID:5648
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"3⤵PID:228
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"3⤵PID:5856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"3⤵PID:5852
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"3⤵PID:5668
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"3⤵PID:2740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"3⤵PID:5848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D10/Analytic"3⤵PID:5904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"3⤵PID:5920
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/Analytic"3⤵
- Clears Windows event logs
PID:5932
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/Logging"3⤵PID:5948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"3⤵PID:5968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"3⤵PID:5976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectSound/Debug"3⤵PID:5760
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"3⤵PID:9728
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectWrite/Tracing"3⤵
- Clears Windows event logs
PID:9740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Disk/Operational"3⤵PID:9752
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"3⤵PID:9764
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"3⤵PID:9776
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"3⤵
- Clears Windows event logs
PID:9788
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"3⤵PID:9800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"3⤵PID:9812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"3⤵PID:9824
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Documents/Performance"3⤵PID:9836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"3⤵PID:9848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"3⤵PID:9860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Performance"3⤵PID:9872
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxpTaskRingtone/Analytic"3⤵
- Clears Windows event logs
PID:9884
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"3⤵PID:9896
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EFS/Debug"3⤵
- Clears Windows event logs
PID:9908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Analytic"3⤵PID:9920
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Debug"3⤵PID:9932
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Operational"3⤵PID:9944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"3⤵PID:9960
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventCollector/Debug"3⤵PID:9972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventCollector/Operational"3⤵PID:9984
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"3⤵
- Clears Windows event logs
PID:9996
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog/Analytic"3⤵PID:10008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog/Debug"3⤵
- Clears Windows event logs
PID:10020
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Analytic"3⤵PID:10032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Debug"3⤵PID:10044
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Operational"3⤵PID:10056
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"3⤵PID:10068
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"3⤵PID:10080
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Feedback-Service-TriggerProvider"3⤵PID:10092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"3⤵PID:10104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"3⤵PID:10116
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Folder"3⤵PID:10128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Forwarding/Debug"3⤵PID:10140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Forwarding/Operational"3⤵PID:10152
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GettingStarted/Diagnostic"3⤵PID:10164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GroupPolicy/Operational"3⤵PID:10176
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HAL/Debug"3⤵PID:10188
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenter/Debug"3⤵PID:10200
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenter/Performance"3⤵PID:10212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"3⤵PID:10224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Help/Operational"3⤵PID:10236
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:5760
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:9728
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:9740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:9752
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:9764
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup-ListenerService"3⤵PID:9776
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HotStart/Diagnostic"3⤵
- Clears Windows event logs
PID:9788
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HttpService/Trace"3⤵PID:9800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IKE/Operational"3⤵PID:9812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IKEDBG/Debug"3⤵PID:9824
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPBusEnum/Tracing"3⤵
- Clears Windows event logs
PID:9836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"3⤵PID:9868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"3⤵PID:9876
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-International/Operational"3⤵PID:9904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"3⤵PID:9916
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"3⤵PID:9928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"3⤵PID:9940
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"3⤵PID:9952
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"3⤵PID:9968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"3⤵
- Clears Windows event logs
PID:9980
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"3⤵
- Clears Windows event logs
PID:9992
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"3⤵PID:10004
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"3⤵PID:10016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-File/Analytic"3⤵PID:10028
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"3⤵PID:10040
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"3⤵PID:10052
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Diagnostic"3⤵PID:10064
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"3⤵PID:10076
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"3⤵PID:10088
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"3⤵PID:10100
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"3⤵PID:10112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"3⤵
- Clears Windows event logs
PID:10120
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"3⤵PID:10136
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"3⤵
- Clears Windows event logs
PID:10148
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"3⤵PID:10160
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"3⤵PID:5892
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"3⤵PID:10164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"3⤵
- Clears Windows event logs
PID:10176
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"3⤵PID:10188
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"3⤵PID:10200
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"3⤵
- Clears Windows event logs
PID:10212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Known"3⤵PID:10224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-L2NA/Diagnostic"3⤵PID:10236
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LDAP-Client/Debug"3⤵
- Clears Windows event logs
PID:5760
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"3⤵PID:9728
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"3⤵PID:9740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"3⤵PID:9780
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"3⤵PID:9796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MCT/Operational"3⤵PID:9804
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"3⤵PID:9816
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"3⤵PID:9828
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"3⤵PID:9840
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Admin"3⤵PID:9856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Debug"3⤵PID:9864
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Diagnostic"3⤵PID:9872
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Admin"3⤵PID:9900
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Analytic"3⤵PID:9912
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Debug"3⤵PID:9924
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Operational"3⤵PID:9936
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"3⤵PID:9948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"3⤵PID:9964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"3⤵PID:9976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"3⤵PID:9988
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"3⤵PID:10000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MobilityCenter/Performance"3⤵PID:10012
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NCSI/Analytic"3⤵PID:10024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NCSI/Operational"3⤵PID:10036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"3⤵PID:10048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"3⤵PID:10060
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS/Diagnostic"3⤵PID:10072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS/Operational"3⤵PID:10084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NTLM/Operational"3⤵PID:10096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"3⤵
- Clears Windows event logs
PID:10108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Narrator/Diagnostic"3⤵
- Clears Windows event logs
PID:10124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetShell/Performance"3⤵PID:10132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"3⤵PID:10144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkAccessProtection/Operational"3⤵PID:10156
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkAccessProtection/WHC"3⤵PID:10168
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkLocationWizard/Operational"3⤵PID:10184
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"3⤵PID:10196
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProfile/Operational"3⤵PID:10208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"3⤵PID:10220
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"3⤵PID:10232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NlaSvc/Operational"3⤵PID:6112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLEACC/Debug"3⤵PID:9732
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"3⤵PID:9748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-Machine/Diagnostic"3⤵PID:9756
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"3⤵PID:9772
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Debug"3⤵PID:9784
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Operational"3⤵PID:9792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"3⤵PID:9808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OneX/Diagnostic"3⤵PID:9800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OobeLdr/Analytic"3⤵PID:9832
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PCI/Diagnostic"3⤵PID:9844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ParentalControls/Operational"3⤵PID:9836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"3⤵PID:9868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PeopleNearMe/Operational"3⤵PID:9876
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"3⤵PID:9904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"3⤵PID:9916
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"3⤵PID:9928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"3⤵PID:9940
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"3⤵
- Clears Windows event logs
PID:9952
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Analytic"3⤵PID:9968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Operational"3⤵PID:9976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"3⤵PID:9988
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Admin"3⤵
- Clears Windows event logs
PID:10000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Debug"3⤵PID:10012
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Operational"3⤵PID:10024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"3⤵
- Clears Windows event logs
PID:10036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"3⤵PID:10048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"3⤵PID:10060
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"3⤵PID:10072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC/Debug"3⤵PID:10084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC/EEInfo"3⤵PID:10096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"3⤵PID:10108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoost/Operational"3⤵PID:10124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"3⤵PID:10132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"3⤵PID:10144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Recovery/Operational"3⤵PID:10156
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"3⤵PID:9852
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteApp"3⤵PID:10184
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"3⤵PID:10196
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"3⤵PID:10208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"3⤵PID:10220
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"3⤵PID:10232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"3⤵PID:6112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"3⤵PID:9732
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"3⤵PID:9748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"3⤵PID:9756
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"3⤵PID:9772
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ResourcePublication/Tracing"3⤵PID:9784
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RestartManager/Operational"3⤵PID:9792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Search-Core/Diagnostic"3⤵PID:9808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"3⤵PID:9800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"3⤵PID:9832
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"3⤵PID:9844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-IdentityListener/Operational"3⤵PID:9836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP/Perf"3⤵PID:9868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sens/Debug"3⤵PID:9876
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ServiceReportingApi/Debug"3⤵PID:9904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Services-Svchost/Diagnostic"3⤵PID:9916
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Services/Diagnostic"3⤵PID:9928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Setup/Analytic"3⤵PID:9940
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupCl/Analytic"3⤵PID:9952
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupQueue/Analytic"3⤵PID:9968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupUGC/Analytic"3⤵
- Clears Windows event logs
PID:9976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"3⤵PID:9988
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"3⤵PID:10000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"3⤵
- Clears Windows event logs
PID:10012
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"3⤵PID:10024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"3⤵PID:10036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"3⤵PID:10048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"3⤵PID:10060
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/Diagnostic"3⤵
- Clears Windows event logs
PID:10072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"3⤵PID:10084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Shwebsvc"3⤵PID:10096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"3⤵PID:10108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shsvcs/Diagnostic"3⤵PID:10124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sidebar/Diagnostic"3⤵PID:10132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"3⤵PID:10144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Spell-Checking/Analytic"3⤵PID:10156
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SpellChecker/Analytic"3⤵PID:9852
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StickyNotes/Admin"3⤵PID:10184
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StickyNotes/Debug"3⤵PID:10196
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StickyNotes/Diagnostic"3⤵
- Clears Windows event logs
PID:10208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StorDiag/Operational"3⤵PID:10220
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StorPort/Operational"3⤵PID:10232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Subsys-Csr/Operational"3⤵PID:6112
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Subsys-SMSS/Operational"3⤵PID:9732
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Superfetch/Main"3⤵PID:9748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Superfetch/StoreLog"3⤵PID:9756
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sysprep/Analytic"3⤵PID:9772
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"3⤵PID:9784
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TCPIP/Diagnostic"3⤵PID:9792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msctf/Debug"3⤵PID:9808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msctf/Diagnostic"3⤵PID:9860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msutb/Debug"3⤵PID:9892
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TSF-msutb/Diagnostic"3⤵
- Clears Windows event logs
PID:9896
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TZUtil/Operational"3⤵PID:9908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Debug"3⤵
- Clears Windows event logs
PID:9920
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Diagnostic"3⤵PID:9932
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskScheduler/Operational"3⤵PID:9944
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TaskbarCPL/Diagnostic"3⤵PID:9960
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"3⤵PID:9972
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"3⤵PID:9984
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"3⤵
- Clears Windows event logs
PID:9992
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"3⤵PID:10004
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"3⤵PID:10016
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"3⤵
- Clears Windows event logs
PID:10028
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"3⤵PID:10044
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"3⤵PID:10052
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"3⤵PID:10036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"3⤵PID:10048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"3⤵PID:10060
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"3⤵
- Clears Windows event logs
PID:10072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"3⤵PID:10084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"3⤵PID:10096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"3⤵PID:10108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"3⤵PID:10124
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"3⤵PID:10132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"3⤵PID:10144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"3⤵PID:10156
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"3⤵PID:9852
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"3⤵PID:10184
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"3⤵PID:10196
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"3⤵PID:10208
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"3⤵PID:13736
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"3⤵PID:13748
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"3⤵PID:13760
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ThemeCPL/Diagnostic"3⤵PID:13772
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ThemeUI/Diagnostic"3⤵PID:13784
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-TunnelDriver"3⤵PID:13796
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UAC-FileVirtualization/Operational"3⤵PID:13808
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UAC/Operational"3⤵PID:13820
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAnimation/Diagnostic"3⤵PID:13832
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAutomationCore/Debug"3⤵PID:13844
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAutomationCore/Diagnostic"3⤵PID:13856
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIAutomationCore/Perf"3⤵
- Clears Windows event logs
PID:13868
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UIRibbon/Diagnostic"3⤵PID:13880
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-USB-USBHUB/Diagnostic"3⤵PID:13892
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-USB-USBPORT/Diagnostic"3⤵PID:13904
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User"3⤵
- Clears Windows event logs
PID:13916
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User"3⤵
- Clears Windows event logs
PID:13928
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User"3⤵PID:13940
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-User-Loader/Analytic"3⤵PID:13952
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserModePowerService/Diagnostic"3⤵PID:13964
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"3⤵PID:13976
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/DeviceNotifications"3⤵PID:13988
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/Performance"3⤵
- Clears Windows event logs
PID:14000
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UserPnp/SchedulerOperations"3⤵PID:14012
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-UxTheme/Diagnostic"3⤵PID:14024
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VAN/Diagnostic"3⤵PID:14036
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VDRVROOT/Operational"3⤵PID:14048
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VHDMP/Operational"3⤵PID:14060
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VWiFi/Diagnostic"3⤵PID:14072
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VolumeControl/Performance"3⤵
- Clears Windows event logs
PID:14084
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"3⤵
- Clears Windows event logs
PID:14096
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WABSyncProvider/Analytic"3⤵
- Clears Windows event logs
PID:14108
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"3⤵PID:14120
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WER-Diag/Operational"3⤵PID:14132
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WFP/Analytic"3⤵PID:14144
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WFP/Operational"3⤵PID:14156
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WLAN-AutoConfig/Operational"3⤵PID:14168
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"3⤵PID:14180
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"3⤵PID:14192
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMI-Activity/Trace"3⤵PID:14204
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPDMCCore/Diagnostic"3⤵
- Clears Windows event logs
PID:14216
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPDMCUI/Diagnostic"3⤵PID:14228
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"3⤵PID:14240
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"3⤵PID:14256
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WMPNSSUI/Diagnostic"3⤵PID:14268
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"3⤵PID:14280
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-ClassInstaller/Operational"3⤵
- Clears Windows event logs
PID:14292
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"3⤵
- Clears Windows event logs
PID:14304
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"3⤵PID:14316
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"3⤵PID:14328
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WSC-SRV/Diagnostic"3⤵PID:9736
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WUSA/Debug"3⤵PID:13740
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-MM-Events/Diagnostic"3⤵PID:13756
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic"3⤵PID:13764
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-SVC-Events/Diagnostic"3⤵PID:13776
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WWAN-UI-Events/Diagnostic"3⤵PID:13788
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WebIO-NDF/Diagnostic"3⤵PID:13800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WebIO/Diagnostic"3⤵PID:13812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WebServices/Tracing"3⤵PID:13824
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Concurrency"3⤵PID:13836
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Power"3⤵PID:13848
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Render"3⤵
- Clears Windows event logs
PID:13860
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/Tracing"3⤵PID:13872
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Win32k/UIPI"3⤵
- Clears Windows event logs
PID:13884
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinHTTP-NDF/Diagnostic"3⤵
- Clears Windows event logs
PID:13896
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinHttp/Diagnostic"3⤵PID:13908
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinINet/Analytic"3⤵PID:13924
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinRM/Analytic"3⤵PID:13932
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinRM/Debug"3⤵PID:13948
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WinRM/Operational"3⤵PID:13956
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windeploy/Analytic"3⤵PID:13968
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:13980
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:13992
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:14008
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:14020
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:14032
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Windows"3⤵PID:14044
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsBackup/ActionCenter"3⤵PID:14056
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsColorSystem/Debug"3⤵PID:14068
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsColorSystem/Operational"3⤵
- Clears Windows event logs
PID:14080
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsSystemAssessmentTool/Operational"3⤵PID:14092
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsSystemAssessmentTool/Tracing"3⤵PID:14104
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-WindowsUpdateClient/Operational"3⤵PID:14116
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wininit/Diagnostic"3⤵PID:14128
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winlogon/Diagnostic"3⤵PID:14140
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winlogon/Operational"3⤵PID:14152
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winsock-AFD/Operational"3⤵PID:14164
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winsock-WS2HELP/Operational"3⤵PID:14176
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Winsrv/Analytic"3⤵PID:14188
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wired-AutoConfig/Diagnostic"3⤵PID:14200
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wired-AutoConfig/Operational"3⤵PID:14212
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wordpad/Admin"3⤵PID:14224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wordpad/Debug"3⤵PID:14232
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Wordpad/Diagnostic"3⤵PID:14252
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-mobsync/Diagnostic"3⤵PID:14260
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ntshrui"3⤵PID:14276
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-osk/Diagnostic"3⤵PID:14288
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-stobject/Diagnostic"3⤵PID:14300
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "OAlerts"3⤵PID:14308
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Security"3⤵PID:14324
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Setup"3⤵PID:10224
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "System"3⤵PID:13744
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "TabletPC_InputPanel_Channel"3⤵
- Clears Windows event logs
PID:13736
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WINDOWS_MP4SDECD_CHANNEL"3⤵PID:13768
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WINDOWS_MSMPEG2VDEC_CHANNEL"3⤵PID:13760
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WINDOWS_WMPHOTO_CHANNEL"3⤵
- Clears Windows event logs
PID:13792
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WMPSetup"3⤵PID:13804
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "WMPSyncEngine"3⤵PID:2136
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "Windows"3⤵PID:13800
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin"3⤵PID:13812
-
-
C:\Windows\system32\wevtutil.exewevtutil cl "muxencode"3⤵PID:13824
-
-
-
\??\c:\Windows\system32\vssadmin.exe"c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2500
-
-
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\system32\powercfg.exepowercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5692
-
-
-
\??\c:\windows\system32\schtasks.exe"\\?\c:\windows\system32\schtasks.exe" /create /xml "C:\Windows\TEMP\config50.xml" /tn "\Microsoft\Windows\Task Manager\Task Manager"2⤵
- Creates scheduled task(s)
PID:5644
-
-
C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe"C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe" -takescreenshot2⤵PID:17728
-
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" delete defser2⤵
- Launches sc.exe
PID:58980
-
-
\??\c:\Windows\system32\vssadmin.exe"c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:58988
-
-
\??\c:\windows\system32\wbadmin.exe"c:\windows\system32\wbadmin.exe" delete catalog -quiet2⤵
- Deletes backup catalog
PID:59044
-
-
\??\c:\Windows\System32\wbem\WMIC.exe"c:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:59220
-
-
\??\c:\Windows\System32\cmd.exe"c:\Windows\System32\cmd.exe" /c del /S /Q /F c:\windows\temp\2⤵PID:59380
-
-
\??\c:\windows\sdelete.exe"c:\windows\sdelete.exe" -nobanner -z f: c:2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:58500
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5768
-
C:\Windows\system32\taskeng.exetaskeng.exe {156B5B53-8156-42C5-83AC-60834CB5029A} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:5812
-
\??\c:\windows\taskmgr.exec:\windows\taskmgr.exe 192⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6040 -
\??\c:\windows\taskmgr.exe"c:\windows\taskmgr.exe" 173⤵
- Executes dropped EXE
PID:5724
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:30216
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:59108
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:59140
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:59168
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Indicator Removal
4File Deletion
3Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
556B
MD55ec93749cf40deae3a79cb1fcbc8a0a3
SHA1299c9272db3aca1c4f0152ae7c8e6322b44010b0
SHA256428d3348f9cf67e5ade4dab09626a939e1289491c0c08c01775a0661e4131c2d
SHA512d5d3b8189871468539eae4520b9932ac2aa102cbd5db092c33a9f577db73746335b478856653344d1e5431c764491b45dc729e335ee473c1c940e29769e88720
-
Filesize
4.1MB
MD56bb525416ee8671e08053e9f8ebe2e82
SHA116a23a0bf249569b74d7054ac902452430629070
SHA256434b8541f59a41bac13be2bc19b86a9fd08b0c9d0d9c3519f51ba7042761d4f4
SHA512555b845c5ef78354e5cd7477eb2a8276b31f36c90de1e6d2ffee511b12d75d3182e806ee340e9eebcdda54404e02efbc216217c82577fb62361c44199f6c5b86
-
Filesize
797B
MD57a3c89da842d0023b5b418ffcde0c84a
SHA17fe4ed864ff72741fc9ae2b6faa4ccae362ec6a5
SHA256048a801114d9c489bb81b999de38acf93169e1886ddd5dc505fb3ecc5fec8df3
SHA51289ef4a66d5af415a0656166b922f1ae61207d7b252debe93dfd536414e85fdb9af619898fd3dc3d3a2c476eb43cddbfaec5c91aacda08adc97efdd3732c58d39
-
Filesize
1KB
MD517f61b9370e59ae4921e169a0f4e8383
SHA188022388af3cc18db656d58568f578d87e4ef637
SHA256ff9afd5cd72a7f663fa003b1a68a0e6943d81690581414da842c2b6c38d3f804
SHA51239a915aa0afc399db6cb94ae12ad8a01ed2849b1456cc49fe04d4b93ceb9a24b23c647de29883df3f578b2df063dc717752714a538e8ec0a27e55260f1754df6
-
Filesize
770B
MD542bbd3ed6a91e0f2fc21b1c1e35ab4ef
SHA1daf8126937e4f250f75851b2329fbd9b31f1a7c9
SHA2560f44ebff00b39dd49529572c58d0a08f7c959bb409f04e58871a7a3293b9b7c0
SHA51238f35fbf91540781824e9affe1b767a92313424c24a006170b946fa9a3a90298f3d733b34d90c5549f1cc1ef2ca1a279942e84b98afb878cc4bda577695c32d3
-
Filesize
643B
MD5a71ade893f20f62e8e011306b0ad9871
SHA176e54b99082a4dfe2d4f4c33d34c3cc9b75e677e
SHA256e88b74300be26dc89c036c53bfc7e28f2938d9f64cb219e57adb1bf4c48c91a5
SHA512db2845c253e89ff558a802210e2da4de41b58217e42c0a04d346c733243076e44a9967918ebb2b4052c05f3c19236b5ef036de019655be5d9fae50e16c7d6914
-
Filesize
2KB
MD51cbabedf267a560d2a4e6247da2e2532
SHA19394ead2e02855735624f5b75ac9f0cec7cef483
SHA2561b97dcf8fe1e607b291eb2169dbd6b2b687f02c33f25b1cfdc6b611b8de27288
SHA512c671008d4f4f4bc3f774c341d85ba0fab3c29496f4a0d581a21454083a9cc4dcbe79fdb8673af44b46b023caddb5a6ea435a00ee99ce2a15425f83819e84b575
-
Filesize
2KB
MD5d5d794d31496c3da2789ff64102bb8a8
SHA11725dd4e4029191e7f82e84308f931477aa86dc1
SHA256673d6a4c0f0756f428e813108ca14b6a0bcbc1f3b72377549409e4f064e8bcaf
SHA512e06c176c806e53b2ed1f3207b7d0552fdd1282eb581ce6c8c39881cf0c6983f93f71b7449cd79a0580996ec1b6cc46db1ad4b59eae1cdc00278c97b874956b50
-
Filesize
1KB
MD5accba632029773f6c42154dd13a69fe5
SHA109170703d42ee2575f813e7c9c13aef54fb08cd4
SHA2560b201e333b0065b0d04ac1c46fc5b72f97da09738783b5ef688a7e98b3db2b09
SHA51206052c5b4b7cfe03cf0631653c23a3a02b299256e2f85cf3f124d2be2a4c108a28817c92a47ddbe48205fa918213e54f1fe41464a160a7b4a72ac7dd1e6c82e4
-
Filesize
1KB
MD577789ba9e1ab771398ebc068e10c4c19
SHA1b5115488cde8886c092a70ca7532871c43c7378b
SHA256d552f2753dfb116c8d02a5006381cbe169aba5cb7e57b6854170ed012ccc5a9d
SHA512b1865b9ad0cd5eb14715a69c7bd27dd7aa9308ef0259e99dd881d6753db2e01c01468a14cbcdbb623919b659ba46c23184756f3ffd83633bee201776e06e4e92
-
Filesize
601B
MD5f34caf924acaad452739175b6a152146
SHA15981dc8ca5dd76a89c1a759cc8f6c23d0b0bdc56
SHA2565ab23757d7f285c5ffb1d0206d89f93ee7d4a508f0429de8e2fce4c3be63c06d
SHA512ad42d6ed8c50a9a1b483051ac5a800f423ca355e5d8937517f38a8f4740f02ec95e7538c10d0013f07707599bb7169c214e899eff07a5bc094fad80930501f3d
-
Filesize
1KB
MD5e1b506f191258ff2eb15eb0cacb93d11
SHA197a96c575df932eb5cb82641d8b168fe572ae690
SHA256cad00963413b90b6eeec0f2f25450671990bbb177068eea60e99424d691dfc7e
SHA5126ba4831b7fdf1ad9b78d8c26efe3188891fa9545c3c6e739d95b6a8d44eda6f5070955ab96c1028853d4c7c64f2a08e545c465da1130ef560f99f0f624c12c78
-
Filesize
869B
MD5e201ce19150c1d7bd5c01360955fb45d
SHA1e81c2beabddbb02d861d41f9741c614863835d18
SHA256d7f86eca05f4ef2248e359431ac168d92cea0fd3c703fc59119327ac6dc24461
SHA512200bc87ea9e22072bb7c76defe3115a15d0c046a70d632073e454cac9abcfe319ec314c757c65a4cc7fd21139cfc8dc31e45c9fc081db7de71c628fdceadaf78
-
Filesize
21B
MD5ae5b870422a894681852149c70f30f81
SHA104f0b227483c14af01f7401cdf9658878e5edfe7
SHA2560658d38ddff34224da386c983352798cc4770351b7ce80879beb7b601adc26d8
SHA512d0ba1e149fd1b708890c4033f2015a3b3b273427984ef9ee462f697d7ce5186a102448bd282560fd2a0fe49f0f72a9408366b86f36979d0f54db373d38dde811
-
Filesize
764KB
MD5db8f8e3038635ff9d6fc9b069c104bbe
SHA1633feba89ebec29f1bbfde666322caa186697de0
SHA2564bcaee3d8b8b3f469b6c14a9732ef62d507ee30b160116f93da0066e223a8a9b
SHA51266afd63f431698595fff2378554b87b29f11e711ac8697cf9e5d319755534bd46ce87bfeed0082150bde8786bfe5bc4d285a7247fc0b8f98403bc9502ea65ae4
-
Filesize
601B
MD574b7f7ae96d4f5d9ea5a5dbfd8962158
SHA139c9c7154ba112758b013720af387077add1d758
SHA256840bfc75ec5bc6d616120dd61818198d8f3b05d0685ebf0f3a0dc2a7ec9a2a9c
SHA5127408c9950beda386a34ad73d87bc8d7229611438116402b52bac09e9f58b9b49c8ab7c54054a2c8d3e300d15627608cb6894618f713366e2423d0690d899db60
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
Filesize
451B
MD5966fa6d7f47b807705fdb1a401f26dcc
SHA17f7647de33b0dc139a81d3b0640942eadee634fa
SHA2569567079b3c6d8a9653ca6511638473ea9aa58843223e6fbd410491d440848b97
SHA5124f52f1db11ba0a3c26e2ed0be4b56ce535e5ca35e4a7a3f9d3bccf91c4665d319749ee2fd0cf6bffac07208f73367a7c2a21b452111ddca046a052e5b95bb7e7
-
Filesize
1.0MB
MD5817435d7d31398bd37f969c18b53ff44
SHA1f109ec44377d8b9b8178c5625a3cbc835e3cdf99
SHA256c3b0fa67103440074a6b63e5c297956901d67580c5ae201e37db31f86dab0470
SHA51231073d27e1646ad7e5eecb9c42080f6d16ed1264b8e9812c13d3771bdabb8855f59e9a353f88cf33b0a92bd59e6f902333e4738ab6d6fed191416680ff47d466
-
Filesize
451B
MD5b3926deb07e4b21afe24cd372ac6ef2b
SHA18ea4d07e198028e4c58b48c3773f811063ebb66a
SHA2563d5fd07c14099589e48bde9aec20aed123ccdcbbc3b075deef040ba485dd1f65
SHA512d03945edc5d7f483910fa138ba9d11e3e868bd35d57d530245699dbd46dd3f3f7fe57cbd95205160b58fb3a6bbbb49ff6f79e90515ee34921a3a936b98196577
-
Filesize
451B
MD54b9da5782dd82fed0c058aa7c3dca90f
SHA1e21e75ed8fcd07306ae5e290b991f4618c561014
SHA256d8abd29af066291471fc671046bbacde9a1924791ff6961db3477bdbc324a1af
SHA5129bfda80c706910232db13630132086414ec4e00036e002e6081859a978355bd94c82832fb9ebbf9f3599f5e01a6ff8f34784d91ffda9d4276a1c677d1a2f7e92
-
Filesize
3KB
MD503a1318b03bdb10439d89046c094d4b4
SHA1a95f858b00ba28b81b8b00ea77503dc872a80a12
SHA25655065c3c9c289a9084b0b739121ce46ed8cce7faaeed11f32c8789c5ac3c5d9f
SHA5124916589858730969fbf39d01dcae7426f719bdff39cbba45def14c2927e8eb4d088937b285bb730e7e3734017047b1ac1e12e6e4fcefbf5df3688e0c15f61b7b
-
Filesize
451B
MD51885f7c566d26363521f3ae2e2500e1d
SHA1ae62c28b42cf52c9fa57f850172c81e60c088cf2
SHA25675dbfed0eab217b7a9614b940b065ecbce3e3ca9cda5ea88c3771717b7926aeb
SHA512dbb132ae6cb479e3ed9fc5c365ff0c9a9a22b7e023df02aa13bedef39c4770e275bbf4de4f28d667ee96e8f9f86af28a61f974e28e433a6b0cb5898f31bdffe1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Filesize638B
MD5204af3ebdb03d2da23d1871f4350a9aa
SHA1dd9eb09e72224bfd12a52a460f85443fe5bd20b7
SHA256773125cad053734f8242511ccdbbcd6eae301f20409106bd6bec67d150f74755
SHA512bd582c24a8c360cdba272a0eb645c3610abdf7742713463d341df79ca35e581cf4c4cc26386f4cf9499001aec9704a92bc1a2b906c88b9a00d5ecce3a24fab70
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Filesize601B
MD5901700cc0f00179dff0edb99c5e5a4c7
SHA18c812c6b3a12d8cdd4015702a46ed843c736334a
SHA25666523fb729ee9fbdc835e0ce5d08c0f6e3f6bbc21fc51078602b199bcf9f15b9
SHA512f374ca5f0d48471b25f541d83f0b2fe5a04e434751b14f65e8c1972aa1807fff1f3c501a720a9207f2a7d4ef3a0c07d21e84713be93305b9d625fef1abe4d221
-
Filesize
601B
MD56ebc317f13d59f4e0c04ae120572cbc2
SHA159d9a7580c908c39f4ca795d738337b64ade6499
SHA25699815a5e5fc8c6edb56563035ef12e96fba69ab396b39b4522fc2e568f283b5f
SHA5124571be413a938998b22354afcd6ec9b60e3a3e0808c1452fb424872afc3e23ddbfd5ed7089e0ce8a558b94707c28765772c0a65d304f8cb62c3d090b65f686dd
-
Filesize
903B
MD5c6c252b7b5d50c65608f27815b608a98
SHA1149eb6870278c632f3652f7bd4bfd7f28afc0ce2
SHA2567541ab34504bcdd1365b3a22900a70262d3d294935f86826586ecc192b5b4f32
SHA5126cb40ddcc232aedc2631f6f3a016f93965155d8ea4a5072b32993c82f9fb9466cbb8f01a582e80d2c14db3348ffc391dd717df2a00ce673f30ada865ca4e25d4
-
Filesize
601B
MD56cd2dec1b043fd6b34102e6a47e618a7
SHA10f13715458a00a8c3bf25103c4f2579b5612f23c
SHA2563539fecb54fe31ba463c0b8cc995cec14bbc9bbe0cac811c8586c0912a5d9afa
SHA5125267521b5abc5f05df088190fdfde232d64241965a47653b6adc94c356fac811f72e7402b2186f9d28b38da82334bfc40d340fa16cb2b61b2734462c46df05f0
-
Filesize
317KB
MD5413464de1e9bf354f53d97bf519bd61c
SHA18d192be89956f658e3ca911f9963ea7cee4b8809
SHA256302d1befec0a4d3580d279bcb9bbec1e165e7aa059661ebf4dff8ce64918ddb8
SHA5127fe42d29f7624faf67e776e3e700821d1aa47907d17eae514cc345613d8c25fe65f9efd063db53beca08318e782d3c6294e457d6053bd90236e6463adb09c1a9
-
Filesize
286KB
MD576fd7d6ef1eb022d287aefd49be7c616
SHA1166fe8c51a2e5b2b33bf8cd95024f85cb22f1be0
SHA256af2d51c4ad2cc7da937d0fc5a01513df88b7a2fd08d7618595e0b27fc9ec075e
SHA5125053204e32b5637a72d14242eaeacbf8031c5684602ff8159a25f963ab7e9ce82bf54c1707348c0e73f8f7c8de82a04f3d5fc5260724762da06c837395c42fc7
-
Filesize
127KB
MD5e8cbe42f9ea4d20577dbb5bc36dcab46
SHA12c6dfb350a4969118168efd237a3a0417b48c91a
SHA256b37dcb7d9cc306b3e5e2102e674ffc4518ca79bc7f49ccd8f0751db0ba71a746
SHA51212f43ffdcf59c529905ab01899d38d10a01327141df59d11be64cbdcf747f253994baf107f66d6409e4b0e60bb1b9ad8284dee1cfa56dd46d655bf81e2604046
-
Filesize
159KB
MD520c5d0d07e69e95663a588ae88a8ecab
SHA1261a34bbbd75f694953b733494c0b410c270774d
SHA25665dff089e2f72dc4fe8ee7e0b3902801396c6373276d72f1b4e1f8e539812431
SHA512fc1d8d71814f69e39cc5347fcdd12d0da37f47a6e57e32cfa0e9774db5aca603ef21adc2742a88068e24f6b21dae51fd0b8e01e241f0924f612b6f4cf7002451
-
Filesize
137KB
MD5399e02959a4ae27a89a95688aaa79186
SHA1b35765c7032917c738b9b91cd724222f205a8339
SHA256eccb33a8449367121bb74e4a000d9b8e4780c8d4c8b9f37e9377ec70410b3937
SHA5125b02c2de3504834c41a4adb50d7dcc2a16eb4c65b3bfccac1ec05916cc1f6f99f1f21b40f545446eafe09609ee9c4c7757adad7249d987f5d3a172f620b6bdf7
-
Filesize
190KB
MD5f735df82c1477e15b5bb03a63eb55d03
SHA1e0412882cd27547ad77a2d9fde14540103e0cf1c
SHA256d38cb5a0593a3dc3e921dca51dad73ec0ba1c1c0a4256468d92fb739d5384df1
SHA512990e86b4ddccb17290b0a6854092319ed713a9fab0db35c0ad4450a57c0a7b47cfebf3a79a390ffd7e5cdd1c9025f886fc2356e390bb9fe9057ec50394ae25d2
-
Filesize
222KB
MD5be8672239b53a6194986548d027322cb
SHA165dd39b83b33dde7b5c57dcedc288075e06eda8a
SHA256f6fe19b1ed1bddfb9869b968d120d91a0d68e28923c9f5ee2e64a08b4a0aecdf
SHA512544a793f4e33bd1420c1aab5dc05928bc81ad4aa45d3782112b2ff471b39b94e746abfa4329578fe345a0eeb3a20ca072b2dcfc2a53f5dc9b9636fa166837229
-
Filesize
116KB
MD55e7065dbca8d5c382fe75ff5fa7077a9
SHA10d63e77259104fa3e7fd39e89acfb0e5c53a2af5
SHA256f67529e7f154c89adcaf83ab1db7956458880fb2661614dd12de662ff9db90fc
SHA512e15c741409f81f00ff5f41d485f82f7184c6e14db35a1aaf3d990a932a04171431cd16963aa926a9639fcf85c5a428c3e078aaee967eabb7668f2e8a054ec02d
-
Filesize
233KB
MD5d91ad3381dd94df7ebd2b4ad533b0458
SHA15e5d4ee9563f25042ae0d232422fa528862ddb99
SHA2563fb4fa2b15f2d84a57c829d5ddd1fb21f28ffd6ca7df35ee696e640948152713
SHA512754f6e3a82384c2fd2ee9cb3de5549724adb98f8325cf842b05be988ed186e585d944e50872ec5060d48944d55b63ae277042ed5f674fcafc0ca7cbde5273e74
-
Filesize
201KB
MD55658ac8ee84a969a0c847de919afa03b
SHA1a3907c8675add30df2a52f55f2233d0b326189e2
SHA2560fceafe6b8c238552f932cd3913c8b12629996d59516fb90ee776b7b72ada7b7
SHA512b0dbcf1e7999ae6d3a47f05204187bbaa987f35e1d031a415119c0591187937d20fd9d8ab7117991547c8c154109437d57bcd90e8a6bdd0db53286a22a691a16
-
Filesize
275KB
MD50b691a1f8b218f929fdcbcc7dea133a5
SHA18d2c1bbd4df80e5081f591210650370ddc83137d
SHA256ea1a41a9e2203926abc5bbd6368e5d1c17170d550101894868dfa7f0380eb3f9
SHA5125515e9395d1936e2e6ab9e76ec250550dff226a77218b5bbe08739a18f74d88063b73a7ad71d40bd142299502b5555c8b3d8bd32bb96fd314c141df5fce4b26f
-
Filesize
264KB
MD5da17400ac951b65fcbd36c8c52afb1d9
SHA13c923ee098e0783f3a8cf8595b0e178254cfd5fd
SHA2563dbd12338788cdb0c2f3945ddfb9dee1d20dc18aa0d0805cc70b1a48e6c1987f
SHA5125cc516bbee0becde9a3aed955020661455450b804ce2b9bfe8592332b7d180607982feb4e358be0b318a394c005afb3d8d2c92b121ddf401a268ffb1670a7e8b
-
Filesize
148KB
MD5075facc84ff7bd1b967ae122107c1be3
SHA1ddf1b51911d895ec6571e11f7627cb63549a229d
SHA2562bccc52cf51f62836c5b35462111c52a7b320b33b69161e71b7ff86f8ca04342
SHA51246c285db744e62a1f1bd8bd7b13f4a5aeb80fe3f3661f8a7aa5ed7ac5874cfbb364ed695e2f95700b19906b1ba95ae389c9da25bfe9117897808e5903452d1ce
-
Filesize
296KB
MD5e9a1cb05e40d6b582d8528b7cb6caf65
SHA1bfd7d8105b6cef35f3e8af27636830d8fa90dc8f
SHA2565827970d8f58c491af959ce928a3fc94c1660365dab48448783432ebd2fd5a44
SHA5120a757b4ff50e7a9e75644b812e3ff0c26dafbc82bddf467e508b6173e65b53492e03152385072e1272ae616e69124487fd529596bd7e327e5ddc4fe1b87ec567
-
Filesize
455KB
MD565c30f7f01f0dab4ea22fe2919a809f9
SHA10ad45acf81dcf98ebe1a0ea3ad267c0870c3302e
SHA2565797d4f3e725c0a4b0bfff9c0a8a08f551d2630248b218597787c5dc5873a6d9
SHA5127bf857d8ca0bd7dc18751caf5ed09a03979ea36f47c3db75948f073873493f6a5a3eb2cc6ce5e39162f4441f9db13ddec4bc2edfd814f1066909d9bc026c1aaa
-
Filesize
254KB
MD5c33dd0466d27f1f7a908bff0d555c1bb
SHA12f7f1f8537abd44cf1dd480974e120373b8f5576
SHA256309161c3275fbc0f2f8aa28ce367586ede1835daa035d93ffa37c746c8d58e8d
SHA5126a32d018c5d883c7ac5ae38628335e84e1abcc62fe8a8ebb0d83a8ab3e8bf980bce2a0a02248cc3daed0c6f2cf2a4c04648ed9a5b5c0406a13797adbd54c8ac6
-
Filesize
307KB
MD5bfac61016fe9917b73fde28e8701eb30
SHA1c050b8fc2624d800a189df2e66e6f93d40b82ff0
SHA2568fe1b62206d613d48deaf948c24dc04ed0284b88a502490231be1d65bddd936a
SHA5126c437e87aa036788c44fe14eb180a8d5121288a5a17b94d212bdf65880d695fb846037604ab5efdf95f396d2853486afe99568886262eb5eb2a67d48053b167b
-
Filesize
243KB
MD5ff402e617e677e953d418942c9114cef
SHA1a869a7a1f991a898564d9d65cc9522e8545b0844
SHA2564e17948bdaac617e3b86076371aaa918703fce6f2109a454d7c51b0e944bc277
SHA512cce312994b8b510b816afcaadff8b936ae25690fc95e0a42d8c177f4404db9acb70ffe2e47b87ef4fa620535fc806074712c2fc30e17dab0841431a5a9e8bfaf
-
Filesize
328KB
MD59ce72ec1f236337096116d276b6d0514
SHA19d9df326eb1df7d022b149af381a6d20c7e635b2
SHA25696303502d52e2aff84b009b68ea2cda31af1beb550931b637454057208854a67
SHA51231bc4e0a5bad75af6eb3fc205f3d19584959785073394c660f5d8111848165706cfb9604d7b4cfc95c024a91fbabd12eb1ca039814e35278be78de4852eacf84
-
Filesize
211KB
MD519d39b61f4b36c699fea5514a4764d0a
SHA1870e72d6823d5c8ee799acc317605ef0bb6f7e4f
SHA2563869ba71fb3d38788be106e29885a712b86f82bcf5476203c50ec7746a4d2b98
SHA512452b7eeae47a0840764847ec0634ef3172002305b1f664c5733e2aa0b4a5f8921e406ca3608d40472d474531400d9a5709f3a7be08234eeae206e2c4b7dabb64
-
Filesize
169KB
MD574f6024e290b3879a08e85781f76c0ad
SHA18d76abd994edd8b360589c5e41a2142502926523
SHA256078803609bf4f95649e60bcd64ed0c12cf92cae74afee0028ca8f2943856c755
SHA512f826c7c248d273820ff77b55ab169970beab42f1c1d24471a82f5c7fc7cc81d24dfda5fa16d5d1651ba2c2545118ab53115ab9de9b7599449c1859fe874119b0
-
Filesize
180KB
MD54ae8daa436e07f569bfa978eafdfeee8
SHA1abaaebf3ef273f4bd040e8c27e0c647f57b6afe0
SHA2568cdb4dae435f7d78d44dbb372cb65308ce54bdfafe8ab61643e8abccd5dcb05f
SHA5121359e6fbc26475921d6b62e24c3ae7ce005f6cf6abfb4ddcfe992d387a75ece73941d96f4089b2b9fcc6b3bc1fcb3d1f7c2efa6e6a9a93f45bc8b0c74ff65a26
-
Filesize
709B
MD5fd582797f97eb3b6de2acc065e1ecc98
SHA1ebd43c4799750eb66d9389e377c6f7b18bed6520
SHA256a18b2baab81ba2cca156d94a211754faf94feb773e86e845e6bb12f97599005f
SHA5123755224354edb11d6fd85f56e01b90829d004a4a2813b642b4060fc9e74e5b120c9cbe3ea0dc7132d58630b7a3bc65f2032ec75a5c1d880beeaa7e86b370df15
-
Filesize
24KB
MD5f3a5c05468e412d49298d3c4f50d8063
SHA15f5e20d21b6efa45626f1a57e818755f03aeb21e
SHA256492d714d2faaf92cd5289a990cb79ec7ead7993f103309d7d4b77ff5a1a8c96e
SHA5128b1bcb37f6400207209ba418e1b57c5929ac3332791ef71226dfcddb721bda7d5022fed74a953a9b974649b8746c8a04319dd04a24fa3ee24a0f2c6ef2d9d8ca
-
Filesize
601B
MD5b500f9cffa37697877a2c391dc3c0316
SHA1648eb11a9cda77bd19a3536e137c42b193cfe68d
SHA2566faffca34c0add3f4d823061e04f898bc9aab086426356dddd92c2ef58e3eaed
SHA512ebd319fda6f16990ee210fa3f8c530fc95a597462ff7c63bde7496c05f4e6b5db273d190a3bad9a149d6485c43f05f60047a9ba045799e3426f8f7c8992fed50
-
Filesize
601B
MD5a94daf2f3866dca2dfea2dc5f61fab13
SHA1573c684b7249a0cd339f73c95d41f37eed849e48
SHA256119c520c9ba6214a0ddbe361ff854179dccbec335ea2b97253892b25f3c4bf91
SHA51214b78250cf0d04cab8f9e7000e49ab0db3ba93ff917c4c252b4a4576317876df13d3b0f3aea3012cf8ad53253f86faa51688554525a3776854b12f2ab80ab6cc
-
Filesize
601B
MD5624d6abc71ba85210445f15e6718884f
SHA1486eedb879b999d33557c329c6f33612132b6712
SHA256321c879e2d5cc16911f1607813939396a2bad95bd9e9551cfd4fb156352461a2
SHA5125b29c48fcc0b7ab25b787f91203f7a8e7c0b5af390d9621f4629569e1b3a7cd8ca5c8f04da64271709befd81c84dd00131bc9c32c49deeb62bdcd580d69f909c
-
Filesize
4KB
MD56b20d97132935396cb5fe7ae4f8c0770
SHA1d1a2678af6c97e9963fba1cc0ce666dd1909cfc7
SHA25607aee2ce377b7e8766f16ad301c445a50497d1bb847f306a4bffa70eb9aef261
SHA512cee78046f61e73437c27ad535ea11513d12383f61a2ec57eee8017b76b392598028c387ae96f5d064cfae3b7a7e612754067349c8baa5ecbaa06e72fe0ff3fc5
-
Filesize
5KB
MD5cf744f4eb67a3a9d6278c9dcadd3f3a4
SHA1acb3167cc3ba9f129896a6860d26a6dd92cead1a
SHA256b9760e95692cddbd0b58edfd413286fdb93253c98be8d5bf1b35370e78ef48b9
SHA512e06e7fe541023b200c558b440da37a723feac1f836e90a5b52883d5777846c269488b56c504e68286c389ab64ac50a185a58e72231b0b36821b17605ed6f431a
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
20B
MD54b7a862e7e00721440555d309db838e1
SHA12a4600869de69a00d4aee1c77ac67c5cd1aa6aa7
SHA2566f02f93d433d3b58f57b54194141e749a1b5948d33e6538bc6fb2ec854f45143
SHA5128e7a694b6d59de26c83de1a7b9e7233bb785bff0257a78345f90dbf731fa41a63dcf4d8e5540a3dd4479ebe3d9613cc0d596fa0e964595b483e67443f2072626
-
Filesize
312B
MD54560615202d31de07b7894c8fcd7b7b2
SHA18d117fd2f4479cde79fc4ad2c8501ffa30d93143
SHA256b2704c136bd2e09b6574bc468cc3855b8b607734efb450395d4c364ad1acc440
SHA5129f51ce95e54ca140501b52988ef30155f01ee3b10d6f87dd74d637e1cbbac7a58afa6f5087cdb6295fe048e06fc702984435569bd6d36f48888e46963075a891
-
Filesize
50B
MD5837f9483a4d9fb834d75537beb1c9488
SHA17421df5e92fbd2ef04eac5ede4397e4b87a3b7c2
SHA256ec64e2a730d0e32ff61a98f34ffdda69ea172234f8f432b95766e38c0f898e2d
SHA51237aa585177f560cd8d7b60303e820a7fa08f1a73d5fb79a6bae1f2c14e11d0f2d573059eb4e5c4bccb5021b336531d1eb3076a357b75a02c56570585a271cc69
-
Filesize
142KB
MD55e2b550b801d03c20b759c5f6848a9f8
SHA1c006e2e9872f88c864a558beef2fd448125b2655
SHA256ac2a2c93fb01ef37afa9e75051ca222d37ecaf267867ae1907f293eb6faa2f3c
SHA512dc316b70f4676872edfe4a73f8871c62e129c6d846cfb97911edce35a6510adf9dacc0cac1ab24602a3a9b1edae764a6f993d4d12ca566271bdd4cf03d2984e4