Analysis
-
max time kernel
40s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 22:39
Behavioral task
behavioral1
Sample
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe
Resource
win10v2004-20240412-en
General
-
Target
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe
-
Size
1.0MB
-
MD5
f5eca9408d0f7e66bf8686fc6f322dea
-
SHA1
c5d3cb9c5bf02dc74ace0b6b3dfbfc7460141a3a
-
SHA256
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130
-
SHA512
76c448b50f51ce829a3f6e7bd21503c8f0a1d0b60b8e0e8d2290543fbf489a77ea8729b3b8d1591a2ef0785ba3f8e3c18cd2f8448c8907d918e16e81e65bb333
-
SSDEEP
24576:5k/vonhpYZQMkZWPNNjZ/AQXwIsceV4+z8F0LdA9:5k/vohp6zhdZeVJnd8
Malware Config
Extracted
F:\$RECYCLE.BIN\ReadMe.txt
https://t.me/secles1bot
http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion
http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion.ly
Signatures
-
Clears Windows event logs 1 TTPs 64 IoCs
Processes:
wevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exepid process 52724 wevtutil.exe 12144 wevtutil.exe 4504 wevtutil.exe 87072 wevtutil.exe 89332 wevtutil.exe 140268 wevtutil.exe 21428 wevtutil.exe 89588 wevtutil.exe 37412 wevtutil.exe 33388 wevtutil.exe 49004 wevtutil.exe 85696 wevtutil.exe 12272 wevtutil.exe 39240 wevtutil.exe 12244 wevtutil.exe 12200 wevtutil.exe 22204 wevtutil.exe 95160 wevtutil.exe 4940 wevtutil.exe 101104 wevtutil.exe 123340 wevtutil.exe 77380 wevtutil.exe 12224 wevtutil.exe 77260 wevtutil.exe 12164 wevtutil.exe 55392 wevtutil.exe 85136 wevtutil.exe 54952 wevtutil.exe 24448 wevtutil.exe 36348 wevtutil.exe 59240 wevtutil.exe 12136 wevtutil.exe 33728 wevtutil.exe 8156 wevtutil.exe 12280 wevtutil.exe 63408 wevtutil.exe 77488 wevtutil.exe 85120 wevtutil.exe 77424 wevtutil.exe 128372 wevtutil.exe 12128 wevtutil.exe 39744 wevtutil.exe 47912 wevtutil.exe 53004 wevtutil.exe 113576 wevtutil.exe 40788 wevtutil.exe 40948 wevtutil.exe 57240 wevtutil.exe 52164 wevtutil.exe 85156 wevtutil.exe 133580 wevtutil.exe 34528 wevtutil.exe 3080 wevtutil.exe 33856 wevtutil.exe 109620 wevtutil.exe 117076 wevtutil.exe 8096 wevtutil.exe 36272 wevtutil.exe 40852 wevtutil.exe 48848 wevtutil.exe 52848 wevtutil.exe 69576 wevtutil.exe 8032 wevtutil.exe 142180 wevtutil.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detects command variations typically used by ransomware 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4736-1-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/296-21-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4632-9269-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4632-28967-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/4632-29002-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Renames multiple (7898) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 12 IoCs
Processes:
resource yara_rule behavioral2/memory/4736-0-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX behavioral2/memory/4736-1-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX behavioral2/memory/4632-2-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX C:\Windows\taskmgr.exe UPX behavioral2/memory/8036-19-0x00000000002F0000-0x0000000000339000-memory.dmp UPX behavioral2/memory/296-21-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX behavioral2/memory/284-30-0x00000000002F0000-0x0000000000339000-memory.dmp UPX behavioral2/memory/8036-31-0x00000000002F0000-0x0000000000339000-memory.dmp UPX behavioral2/memory/284-39-0x00000000002F0000-0x0000000000339000-memory.dmp UPX behavioral2/memory/4632-9269-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX behavioral2/memory/4632-28967-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX behavioral2/memory/4632-29002-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp UPX -
Creates new service(s) 1 TTPs
-
Processes:
wbadmin.exepid process 53552 wbadmin.exe -
Drops file in Drivers directory 10 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Windows\System32\drivers\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\etc\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\drivers\DriverData\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Stops running service(s) 3 TTPs
-
Drops startup file 1 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Executes dropped EXE 2 IoCs
Processes:
taskmgr.exetaskmgr.exepid process 8036 taskmgr.exe 284 taskmgr.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4736-0-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx behavioral2/memory/4736-1-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx behavioral2/memory/4632-2-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx C:\Windows\taskmgr.exe upx behavioral2/memory/8036-19-0x00000000002F0000-0x0000000000339000-memory.dmp upx behavioral2/memory/296-21-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx behavioral2/memory/284-30-0x00000000002F0000-0x0000000000339000-memory.dmp upx behavioral2/memory/8036-31-0x00000000002F0000-0x0000000000339000-memory.dmp upx behavioral2/memory/284-39-0x00000000002F0000-0x0000000000339000-memory.dmp upx behavioral2/memory/4632-9269-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx behavioral2/memory/4632-28967-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx behavioral2/memory/4632-29002-0x00007FF6B9CC0000-0x00007FF6B9F57000-memory.dmp upx -
Drops desktop.ini file(s) 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exeexplorer.exedescription ioc process File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Music\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Music\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Videos\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini explorer.exe File opened for modification C:\Program Files\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Documents\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Links\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\debug\l95hQizUq\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini explorer.exe File opened for modification \??\f:\$RECYCLE.BIN\S-1-5-21-4084619521-2220719027-1909462854-1000\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exe5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\f: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\F: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\D: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\f: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 checkip.dyndns.org -
Drops file in System32 directory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Windows\System32\spp\tokens\skus\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\spp\tokens\skus\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\LogFiles\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\spool\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\F12\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\MsDtc\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\Dism\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mgtdyn.inf_amd64_a6235e923dc4047c\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\Boot\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_system.inf_amd64_184528953a6fb673\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_564561a23e05c7ee\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\Amd64\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmmega.inf_amd64_f35131186d3026aa\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_f2e8231e8b60f214\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_96215b82eaa40fd5\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_a9b96d6c7813082a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbser.inf_amd64_8de53ed035d71856\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\fr-FR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\en\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_1394.inf_amd64_cac08af12caec647\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\intelpep.inf_amd64_2e156c5dc4231642\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_dd534e815632509c\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\volmgr.inf_amd64_b98e2b928f71a2b1\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\AdvancedInstallers\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\dc1-controller.inf_amd64_63236b4ab51ad398\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_e196624c9ed43e83\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\ias\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\acxhdaudiop.inf_amd64_78faaf2062860ce8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\percsas3i.inf_amd64_c17a63dada1eaa02\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\nb-NO\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\Sysprep\ActionFiles\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\buttonconverter.inf_amd64_73b807c3bed63b18\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_apo.inf_amd64_a261b6effa32e5a2\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_barcodescanner.inf_amd64_266a07997c075b30\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\LogFiles\Fax\Incoming\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-TapiSetup\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\pt-BR\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_16fbf6520a254fad\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_f52d5ad58116f6f0\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\spool\tools\Microsoft XPS Document Writer\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\Com\dmp\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_1ae6ea0bf54c0f5c\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Drops file in Program Files directory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter_18.svg 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-pl.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT532.CNV 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\da.pak 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogoCanary.png 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h.png 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main.css 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\he-IL\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\deployment.config 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\mi.pak.DATA 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\plugin.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\ui-strings.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ui-strings.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\or.pak.DATA 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-standard\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\firstrun\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Windows Media Player\en-US\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\InAppSign.aapp 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\selector.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ko-kr\ui-strings.js 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\PREVIEW.GIF 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Drops file in Windows directory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..rtcards-phone-winrt_31bf3856ad364e35_10.0.19041.264_none_3fdfc5c8050178d2\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ntlanui2.resources_31bf3856ad364e35_10.0.19041.1_en-us_f8f80d0b800a44cd\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.hostcompu..l.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_en-us_72ecb99fdc859b53\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-b..-configuration-data_31bf3856ad364e35_10.0.19041.546_none_eaba62c4b31f4bbe\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_dual_prnms005.inf_31bf3856ad364e35_10.0.19041.1_none_1eab1be1d38e5678\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-coreshellapi_31bf3856ad364e35_10.0.19041.153_none_c5d8cff48405ddd0\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dfsui_31bf3856ad364e35_10.0.19041.1_none_0fb1102a9c606306\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-naturallanguage6-base_31bf3856ad364e35_10.0.19041.1_none_06dff86af4d19f08\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-powershell_31bf3856ad364e35_10.0.19041.746_none_2a47504bd1d8220e\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-security-cx-credprov_31bf3856ad364e35_10.0.19041.1_none_49cb5b4151ff3099\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Linq.Queryable\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mfwmaaec_31bf3856ad364e35_10.0.19041.1_none_4a378f6fd3c144a0\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userenv_31bf3856ad364e35_10.0.19041.572_none_6e154087aa2e1290\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.19041.1081_en-us_c0c6a63533856bb7\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.visualc.stlclr_b03f5f7f11d50a3a_4.0.15805.0_none_c44531b1f99cc880\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\msil_microsoft.tpm.resources_31bf3856ad364e35_10.0.19041.1_en-us_f1a171f5526ea79b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bind-filter_31bf3856ad364e35_10.0.19041.1288_none_4bc29d3189d6f141\n\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..rver2008compat-data_31bf3856ad364e35_10.0.19041.1_none_6122514f6b984d71\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..tenanceservice-core_31bf3856ad364e35_10.0.19041.264_none_ade98eac7418f063\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.746_none_fa033ad7aa9be481\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-station_31bf3856ad364e35_10.0.19041.1_none_e29684a3f9213b48\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_pt-br_26e2b4db2a2335ea\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-powershell-events_31bf3856ad364e35_10.0.19041.1_none_8ec330b742668224\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_5bc013fee934617b\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_496670997f866529\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-kernel32_31bf3856ad364e35_10.0.19041.1202_none_087e122b0b81e049\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_networking-mpssvc-svc_31bf3856ad364e35_10.0.19041.1288_none_0edbe2027d0c79b2\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\wow64_fdwnet_31bf3856ad364e35_10.0.19041.1_none_fb6e64fb47d00359\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.19041.1_pl-pl_34114e40f674dea5\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..e-protocolproviders_31bf3856ad364e35_10.0.19041.746_none_d14e7c9238ed667e\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cryptowinrt-dll_31bf3856ad364e35_10.0.19041.746_none_350a7ac2ae852f14\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.19041.746_none_33374e3aacb7c6e6\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-snmp-winsnmp-api_31bf3856ad364e35_10.0.19041.1_none_963e8a9561fff8e9\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-vbc7ui_dll_b03f5f7f11d50a3a_4.0.15805.0_none_78afb7775fbf56e8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\msil_windowsbase_31bf3856ad364e35_10.0.19200.101_none_66b855c43f686971\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-directshow-devenum_31bf3856ad364e35_10.0.19041.746_none_3736f6d89ebab61e\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000463_31bf3856ad364e35_10.0.19041.1_none_9e15b77b0303e2d9\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_res_res_b03f5f7f11d50a3a_4.0.15805.0_none_24da7705397cccf8\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_system.runtime.interopservices_b03f5f7f11d50a3a_4.0.15805.0_none_66716d1156d13247\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-analog-shell-broker_31bf3856ad364e35_10.0.19041.844_none_2c580283f1427887\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ov2fahelper-library_31bf3856ad364e35_10.0.19041.1_none_66b82f27f4cd177d\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..cardsubsystemclient_31bf3856ad364e35_10.0.19041.844_none_f6dbc661d86a47bd\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.1266_en-us_6c716d323af42de7\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-aspnet_perf_dll_b03f5f7f11d50a3a_4.0.15805.0_none_20987526ad09c9fd\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_product-onecore__mi..r-v-socket-provider_31bf3856ad364e35_10.0.19041.906_none_5f81d6a3c14ba91f\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..on-experience-tools_31bf3856ad364e35_10.0.19041.746_none_7d181c223ba21a71\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_dual_volmgr.inf_31bf3856ad364e35_10.0.19041.928_none_30299b60c292d748\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..iser-inboxdatafiles_31bf3856ad364e35_10.0.19041.1202_none_e636843d96260ccd\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-font-truetype-sylfaen_31bf3856ad364e35_10.0.19041.1_none_149fbfda868baffa\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-xaml-maps_31bf3856ad364e35_10.0.19041.264_none_752f4df028ff40af\f\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\speech\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_dual_perceptionsimulationsixdof.inf_31bf3856ad364e35_10.0.19041.1_none_f4ec94a67cd216ca\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..ns-provider-library_31bf3856ad364e35_10.0.19041.789_none_4a4f86b5adbab23a\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-media-devices_31bf3856ad364e35_10.0.19041.746_none_5960a3e43e32ff23\r\ReadMe.txt 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 2344 sc.exe 64 sc.exe 4440 sc.exe 53652 sc.exe 4852 sc.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exeexplorer.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2364 vssadmin.exe 52928 vssadmin.exe -
Processes:
SearchApp.exeSearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\SessionHash = f584cdf90d12d7e1d9b46f4ff6f78e037ba85381d2f31de21d2e96a20b560fa1 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFilesHash = 45d670a6915d836520f4735f635fbcacf7702bc8b3894bac6ee721f9ef9f02ce 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0043006c00690070005300560043005c0074006f006b0065006e0073002e0064006100740000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 8824a32841944104e39823f658c41d81367f1d642c3de545c72cdfc60135fce4 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00630036006400320038003500320062002d0066003800660061002d0031003100650065002d0038006100380039002d003500320035003000660039003800370065006500320039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700320000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 3e855f86b3e8514fda4ced276620d161b849d67894aecf228421ef2e1f820059 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Owner = 18120000ebed48f44e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00630036006400320038003500320062002d0066003800660061002d0031003100650065002d0038006100380039002d003500320035003000660039003800370065006500320039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074002e004c004f004700310000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00630036006400320038003500320062002d0066003800660061002d0031003100650065002d0038006100380039002d003500320035003000660039003800370065006500320039007d002e0054004d002e0062006c00660000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c007700660070005c0077006600700064006900610067002e00650074006c0000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFilesHash = 31ad07c452976f3be29801ce16f0f29199e2f20fec367e38af82089f50523854 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFilesHash = 778829253bff15226dca2a52fff8b5f6a367e6613ebfbc912773e7af3941f714 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b9f29bf97da1e6426e26481a40dd5eb84d48278b7fd8c9758b7c769c9b900c8e 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 27d47669823bba553a235e03d4c7d088e59c2a3a3a0e4fed8cf5f2e616ecd759 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00440075006d00700053007400610063006b002e006c006f0067002e0074006d00700000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = e28757420b39368a91cb5e3f91b5a2e90399ebab4ec8b2785aa91a6a364aabf1 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Owner = 18120000ebed48f44e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFilesHash = 18d9fd86634d282b2c8b689ab6a302a7b3b020282263f6ddb45abbdaad29aee8 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004\Owner = 18120000ebed48f44e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFilesHash = c99dbf233142ca40335ef41615d440d2f4d688e819adb04176c1534bc80a043a 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = e706718c57eee3b87c587061f0703b2c28d69fb0afc7eabb4ab97fa42cd0a36a 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 19bfc09fe136d12540d76f1ccede4264489d92b6926e0bd3cc76880cb6f9a097 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00630036006400320038003500320062002d0066003800660061002d0031003100650065002d0038006100380039002d003500320035003000660039003800370065006500320039007d002e0054004d002e0062006c00660000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d60d54ef642044daab5f2603279050f6d10f50e6e2f33aba360e1b5d4194ab3a 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = dfe83380adc8abf1c26e34ed0123915a3c8c68f7b6753f11fc354a17ba35eb5e 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 538239dbbb19f04c0fb654c292b86cb94eded2a954454e96ff8888fedeff770f 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFilesHash = 52675244f43a9578cb26fea00ee60b9e151634dbc28646d1662beb1224838835 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\Owner = 18120000ebed48f44e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00630036006400320038003500320062002d0066003800660061002d0031003100650065002d0038006100380039002d003500320035003000660039003800370065006500320039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300032002e007200650067007400720061006e0073002d006d00730000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d98a8122a8904812a1d7509b108e291c24556ce98de0a58f3c5128dc977e2dea 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004\RegFilesHash = ded0c03427c0e99c6f28101352b72a023dcc6c67b1e954890acf26883048ba4e 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0055007300720043006c006100730073002e006400610074007b00630036006400320038003500320062002d0066003800660061002d0031003100650065002d0038006100380039002d003500320035003000660039003800370065006500320039007d002e0054004d0043006f006e007400610069006e0065007200300030003000300030003000300030003000300030003000300030003000300030003000300031002e007200650067007400720061006e0073002d006d00730000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFilesHash = 64b283b3f4124e2fd1b83310f6ae263d18525247b89c28963ce5e377eccc7614 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFilesHash = fe6df3e80e1970c64a04b5be4579a61ff357bdb4bc6739b31c98183a00c264b7 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFilesHash = 4b17cc02fec4d3b3280242c4debe122675d3dae14a1a241f20683bc69f0eff56 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c0043006f006e006e0065006300740065006400440065007600690063006500730050006c006100740066006f0072006d005c004c002e00410064006d0069006e005c004100630074006900760069007400690065007300430061006300680065002e00640062002d00730068006d0000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\RegFiles0000 = 5c005c003f005c0043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c0043006c00690070005300560043005c0074006f006b0065006e0073002e0064006100740000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFiles0000 = 5c005c003f005c0043003a005c00500072006f006700720061006d0044006100740061005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c007700660070005c0077006600700064006900610067002e00650074006c0000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFilesHash = c4364a2f38fd3bcf095be6fd6432fd99020e279f01e109d8a18c0e13b307e4af 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = d08671d0da24c25dac5fe1d17287966a42a5a8f7500f326a9425afe635ffa7aa 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00570065006200430061006300680065005c00570065006200430061006300680065005600300031002e0064006100740000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0003\SessionHash = 1593dd20a68840511410d1de962ce060360b8a6fab436604b68ac03ffd7e656d 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0004\RegFilesHash = 85b6d1d1daaf093359ebe2909eb00dd6fb71ae67ff64a7012b690a2470a75481 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\SessionHash = 357f91fef3dad0ac7687cc68415d3397346546299d8157d6f2eaaf4ccd3d1e87 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\SessionHash = 1c2148f7a7c48c312eb7164e6b1f5d6c278155ae18d5d720d786ddfee99be8c9 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\RegFiles0000 = 5c005c003f005c0043003a005c00550073006500720073005c00410064006d0069006e005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c004500780070006c006f007200650072005c007400680075006d006200630061006300680065005f00340038002e006400620000000000 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0001\RegFilesHash = fec997cb485a2c75efaa4195c6634470a62523f54a930b4d9dc038cc34bb2e1a 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 18120000ebed48f44e90da01 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0002\Sequence = "1" 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e7a1cd082b18027fe1c2bff6585616bac4b44dd5999634d5b98a0096176fcdcf 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 2cd42fcc6d200b362b4d0b7a2bac937ab7c8738f166cd1a89f1f9001c687b597 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Modifies registry class 64 IoCs
Processes:
SearchApp.exeSearchApp.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeStartMenuExperienceHost.exeexplorer.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4084619521-2220719027-1909462854-1000\{496CB27A-2C70-4435-933A-2C1241939833} explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "2" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exetaskmgr.exepid process 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 8036 taskmgr.exe 8036 taskmgr.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exevssvc.exepowercfg.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exedescription pid process Token: SeDebugPrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeRestorePrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeBackupPrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeTakeOwnershipPrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeBackupPrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeAuditPrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeSecurityPrivilege 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe Token: SeBackupPrivilege 8048 vssvc.exe Token: SeRestorePrivilege 8048 vssvc.exe Token: SeAuditPrivilege 8048 vssvc.exe Token: SeShutdownPrivilege 8164 powercfg.exe Token: SeCreatePagefilePrivilege 8164 powercfg.exe Token: SeSecurityPrivilege 4436 wevtutil.exe Token: SeBackupPrivilege 4436 wevtutil.exe Token: SeSecurityPrivilege 8080 wevtutil.exe Token: SeBackupPrivilege 8080 wevtutil.exe Token: SeSecurityPrivilege 8116 wevtutil.exe Token: SeBackupPrivilege 8116 wevtutil.exe Token: SeSecurityPrivilege 8180 wevtutil.exe Token: SeBackupPrivilege 8180 wevtutil.exe Token: SeSecurityPrivilege 8056 wevtutil.exe Token: SeBackupPrivilege 8056 wevtutil.exe Token: SeSecurityPrivilege 4504 wevtutil.exe Token: SeBackupPrivilege 4504 wevtutil.exe Token: SeSecurityPrivilege 8056 wevtutil.exe Token: SeBackupPrivilege 8056 wevtutil.exe Token: SeSecurityPrivilege 8184 wevtutil.exe Token: SeBackupPrivilege 8184 wevtutil.exe Token: SeSecurityPrivilege 292 wevtutil.exe Token: SeBackupPrivilege 292 wevtutil.exe Token: SeSecurityPrivilege 8032 wevtutil.exe Token: SeBackupPrivilege 8032 wevtutil.exe Token: SeSecurityPrivilege 8080 wevtutil.exe Token: SeBackupPrivilege 8080 wevtutil.exe Token: SeSecurityPrivilege 8144 wevtutil.exe Token: SeBackupPrivilege 8144 wevtutil.exe Token: SeSecurityPrivilege 8128 wevtutil.exe Token: SeBackupPrivilege 8128 wevtutil.exe Token: SeSecurityPrivilege 276 wevtutil.exe Token: SeBackupPrivilege 276 wevtutil.exe Token: SeSecurityPrivilege 8096 wevtutil.exe Token: SeBackupPrivilege 8096 wevtutil.exe Token: SeSecurityPrivilege 4496 wevtutil.exe Token: SeBackupPrivilege 4496 wevtutil.exe Token: SeSecurityPrivilege 4504 wevtutil.exe Token: SeBackupPrivilege 4504 wevtutil.exe Token: SeSecurityPrivilege 8056 wevtutil.exe Token: SeBackupPrivilege 8056 wevtutil.exe Token: SeSecurityPrivilege 8184 wevtutil.exe Token: SeBackupPrivilege 8184 wevtutil.exe Token: SeSecurityPrivilege 2772 wevtutil.exe Token: SeBackupPrivilege 2772 wevtutil.exe Token: SeSecurityPrivilege 276 wevtutil.exe Token: SeBackupPrivilege 276 wevtutil.exe Token: SeSecurityPrivilege 8096 wevtutil.exe Token: SeBackupPrivilege 8096 wevtutil.exe Token: SeSecurityPrivilege 3080 wevtutil.exe Token: SeBackupPrivilege 3080 wevtutil.exe Token: SeSecurityPrivilege 308 wevtutil.exe Token: SeBackupPrivilege 308 wevtutil.exe Token: SeSecurityPrivilege 8128 wevtutil.exe Token: SeBackupPrivilege 8128 wevtutil.exe Token: SeSecurityPrivilege 2772 wevtutil.exe Token: SeBackupPrivilege 2772 wevtutil.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exepid process 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exepid process 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 22212 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 21364 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 28628 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe 33524 explorer.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
StartMenuExperienceHost.exeStartMenuExperienceHost.exeSearchApp.exeStartMenuExperienceHost.exeSearchApp.exepid process 25820 StartMenuExperienceHost.exe 24048 StartMenuExperienceHost.exe 21168 SearchApp.exe 28636 StartMenuExperienceHost.exe 33376 SearchApp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.execmd.execmd.execmd.exedescription pid process target process PID 4736 wrote to memory of 4852 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 4852 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 2344 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 2344 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 64 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 64 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 4440 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4736 wrote to memory of 4440 4736 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe sc.exe PID 4632 wrote to memory of 1804 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 4632 wrote to memory of 1804 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 4632 wrote to memory of 2364 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe vssadmin.exe PID 4632 wrote to memory of 2364 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe vssadmin.exe PID 4632 wrote to memory of 1756 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 4632 wrote to memory of 1756 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe cmd.exe PID 4632 wrote to memory of 2076 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe schtasks.exe PID 4632 wrote to memory of 2076 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe schtasks.exe PID 1804 wrote to memory of 8084 1804 cmd.exe cmd.exe PID 1804 wrote to memory of 8084 1804 cmd.exe cmd.exe PID 1756 wrote to memory of 8164 1756 cmd.exe powercfg.exe PID 1756 wrote to memory of 8164 1756 cmd.exe powercfg.exe PID 8084 wrote to memory of 4436 8084 cmd.exe wevtutil.exe PID 8084 wrote to memory of 4436 8084 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8080 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8080 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8116 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8116 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8180 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8180 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8056 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8056 1804 cmd.exe wevtutil.exe PID 4632 wrote to memory of 296 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe PID 4632 wrote to memory of 296 4632 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe 5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe PID 1804 wrote to memory of 4504 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 4504 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8056 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8056 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8184 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8184 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 292 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 292 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8032 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8032 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8080 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8080 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8144 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8144 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8128 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8128 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 276 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 276 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8096 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8096 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 4496 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 4496 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 4504 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 4504 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8056 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8056 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8184 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 8184 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 2772 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 2772 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 276 1804 cmd.exe wevtutil.exe PID 1804 wrote to memory of 276 1804 cmd.exe wevtutil.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe"C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\windows\system32\sc.exe"C:\windows\system32\sc.exe" create defser binpath= "C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe" start= auto2⤵
- Launches sc.exe
PID:4852 -
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" delete defser2⤵
- Launches sc.exe
PID:2344 -
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" create defser binpath= "C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe" start= auto2⤵
- Launches sc.exe
PID:64 -
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" start defser2⤵
- Launches sc.exe
PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exeC:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c c:\windows\logg.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil el3⤵
- Suspicious use of WriteProcessMemory
PID:8084 -
C:\Windows\system32\wevtutil.exewevtutil el4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4436 -
C:\Windows\system32\wevtutil.exewevtutil cl "AMSI/Debug"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8080 -
C:\Windows\system32\wevtutil.exewevtutil cl "AirSpaceChannel"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8116 -
C:\Windows\system32\wevtutil.exewevtutil cl "Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8180 -
C:\Windows\system32\wevtutil.exewevtutil cl "Application"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8056 -
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowFilterGraph"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Windows\system32\wevtutil.exewevtutil cl "DirectShowPluginControl"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8056 -
C:\Windows\system32\wevtutil.exewevtutil cl "Els_Hyphenation/Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8184 -
C:\Windows\system32\wevtutil.exewevtutil cl "EndpointMapper"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:292 -
C:\Windows\system32\wevtutil.exewevtutil cl "FirstUXPerf-Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8032 -
C:\Windows\system32\wevtutil.exewevtutil cl "ForwardedEvents"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8080 -
C:\Windows\system32\wevtutil.exewevtutil cl "General"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8144 -
C:\Windows\system32\wevtutil.exewevtutil cl "HardwareEvents"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8128 -
C:\Windows\system32\wevtutil.exewevtutil cl "IHM_DebugChannel"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:276 -
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS-GPIO/Analytic"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:8096 -
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS-I2C/Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4496 -
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-GPIO2/Debug"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-GPIO2/Performance"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8056 -
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-I2C/Debug"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8184 -
C:\Windows\system32\wevtutil.exewevtutil cl "Intel-iaLPSS2-I2C/Performance"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Windows\system32\wevtutil.exewevtutil cl "Internet"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:276 -
C:\Windows\system32\wevtutil.exewevtutil cl "Key"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8096 -
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationDeviceMFT"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3080 -
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationDeviceProxy"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:308 -
C:\Windows\system32\wevtutil.exewevtutil cl "MF_MediaFoundationFrameServer"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8128 -
C:\Windows\system32\wevtutil.exewevtutil cl "MedaFoundationVideoProc"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772 -
C:\Windows\system32\wevtutil.exewevtutil cl "MedaFoundationVideoProcD3D"3⤵PID:276
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationAsyncWrapper"3⤵PID:8168
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationContentProtection"3⤵PID:8080
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationDS"3⤵PID:8148
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationDeviceProxy"3⤵PID:308
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationMP4"3⤵PID:5008
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationMediaEngine"3⤵PID:292
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPerformance"3⤵PID:8032
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPerformanceCore"3⤵PID:5056
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPipeline"3⤵
- Clears Windows event logs
PID:4940 -
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationPlatform"3⤵PID:7952
-
C:\Windows\system32\wevtutil.exewevtutil cl "MediaFoundationSrcPrefetch"3⤵PID:3680
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client-Streamingux/Debug"3⤵PID:280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Admin"3⤵PID:8044
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Debug"3⤵PID:8168
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Operational"3⤵PID:1076
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-Client/Virtual"3⤵PID:3080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-AppV-SharedPerformance/Analytic"3⤵PID:308
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-Licensing-Platform/Admin"3⤵PID:8116
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-Licensing-Platform/Debug"3⤵PID:5052
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Client-Licensing-Platform/Diagnostic"3⤵PID:3592
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IE/Diagnostic"3⤵PID:3368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-IEFRAME/Diagnostic"3⤵PID:5056
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-JSDumpHeap/Diagnostic"3⤵PID:8128
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-OneCore-Setup/Analytic"3⤵PID:3680
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"3⤵PID:5008
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"3⤵PID:8116
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:3592
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:4436
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:3080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:300
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:2772
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:5052
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:8080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:1076
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:8056
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-User"3⤵PID:4436
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AAD/Analytic"3⤵PID:3080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AAD/Operational"3⤵PID:300
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ADSI/Debug"3⤵PID:2772
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ASN1/Operational"3⤵PID:5052
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/General"3⤵PID:8040
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"3⤵PID:3620
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ActionQueue/Analytic"3⤵PID:8036
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-All-User-Install-Agent/Admin"3⤵PID:8028
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AllJoyn/Debug"3⤵PID:8080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AllJoyn/Operational"3⤵PID:2772
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/Admin"3⤵PID:12124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/ApplicationTracing"3⤵PID:12140
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/Diagnostic"3⤵PID:12152
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppHost/Internal"3⤵PID:12164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppID/Operational"3⤵PID:12176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/EXE"3⤵PID:12192
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/MSI"3⤵PID:12208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/Packaged"3⤵PID:12220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppLocker/Packaged"3⤵PID:12232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Admin"3⤵PID:12244
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Analytic"3⤵PID:12260
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Debug"3⤵
- Clears Windows event logs
PID:12272 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"3⤵PID:12284
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-State/Debug"3⤵PID:288
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppModel-State/Diagnostic"3⤵PID:12128
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppReadiness/Admin"3⤵
- Clears Windows event logs
PID:12144 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppReadiness/Debug"3⤵PID:12160
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppReadiness/Operational"3⤵PID:12172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppSruProv"3⤵PID:12184
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeployment/Diagnostic"3⤵
- Clears Windows event logs
PID:12200 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeployment/Operational"3⤵PID:12216
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Debug"3⤵PID:12220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"3⤵PID:12232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Operational"3⤵PID:12252
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppXDeploymentServer/Restricted"3⤵PID:12260
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ApplicabilityEngine/Analytic"3⤵PID:8028
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ApplicabilityEngine/Operational"3⤵
- Clears Windows event logs
PID:12136 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵
- Clears Windows event logs
PID:12128 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:12140
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵PID:12168
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application"3⤵
- Clears Windows event logs
PID:12164 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"3⤵PID:12176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"3⤵PID:12192
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"3⤵PID:12208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"3⤵PID:12204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"3⤵PID:12220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"3⤵PID:12268
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"3⤵PID:12272
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Application-Experience/Steps-Recorder"3⤵PID:2772
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppxPackaging/Debug"3⤵PID:12124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppxPackaging/Operational"3⤵PID:12156
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AppxPackaging/Performance"3⤵PID:12152
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccess/Admin"3⤵PID:12180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccess/Operational"3⤵PID:12164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccessBroker/Admin"3⤵PID:12228
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AssignedAccessBroker/Operational"3⤵PID:12224
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AsynchronousCausality/Causality"3⤵PID:3368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"3⤵PID:12256
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/GlitchDetection"3⤵PID:12244
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Informational"3⤵PID:276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Operational"3⤵PID:5008
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/Performance"3⤵PID:12136
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audio/PlaybackManager"3⤵PID:12180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Audit/Analytic"3⤵PID:12228
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication"3⤵
- Clears Windows event logs
PID:12224 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"3⤵PID:12220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/ProtectedUser-Client"3⤵PID:12268
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"3⤵PID:8068
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"3⤵PID:7952
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-AxInstallService/Log"3⤵PID:304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHPORT/HCI"3⤵PID:12276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"3⤵PID:4080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"3⤵PID:12144
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BTH-BTHUSB/Performance"3⤵PID:288
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"3⤵PID:12192
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"3⤵PID:12180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"3⤵PID:12252
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Backup"3⤵PID:12264
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"3⤵
- Clears Windows event logs
PID:12244 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"3⤵PID:276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Battery/Diagnostic"3⤵PID:7956
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Biometrics/Analytic"3⤵PID:280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Biometrics/Operational"3⤵PID:12280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"3⤵PID:12132
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"3⤵PID:12144
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"3⤵PID:12196
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker/BitLocker"3⤵PID:12216
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker/BitLocker"3⤵PID:12204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BitLocker/Tracing"3⤵PID:12252
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Analytic"3⤵PID:7984
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bits-Client/Operational"3⤵PID:8068
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"3⤵PID:8128
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"3⤵PID:296
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"3⤵PID:8028
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Bluetooth-Policy/Operational"3⤵PID:12124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCache/Operational"3⤵PID:12188
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"3⤵PID:12176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"3⤵PID:12216
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"3⤵PID:12248
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"3⤵PID:8144
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"3⤵PID:3680
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CAPI2/Catalog"3⤵PID:5008
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CAPI2/Operational"3⤵PID:12260
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CDROM/Operational"3⤵PID:12132
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/Analytic"3⤵PID:12164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/ApartmentInitialize"3⤵PID:12208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/ApartmentUninitialize"3⤵PID:12224
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/Call"3⤵PID:12232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/CreateInstance"3⤵PID:12248
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/ExtensionCatalog"3⤵PID:12264
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/FreeUnusedLibrary"3⤵PID:8068
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COM/RundownInstrumentation"3⤵
- Clears Windows event logs
PID:8032 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COMRuntime/Activations"3⤵
- Clears Windows event logs
PID:8156 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COMRuntime/MessageProcessing"3⤵PID:2772
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-COMRuntime/Tracing"3⤵PID:5008
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertPoleEng/Operational"3⤵
- Clears Windows event logs
PID:12280 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"3⤵PID:4080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"3⤵PID:304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"3⤵PID:12240
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Cleanmgr/Diagnostic"3⤵PID:12208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"3⤵PID:12204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CloudStore/Debug"3⤵PID:7984
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CloudStore/Operational"3⤵PID:12268
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CmiSetup/Analytic"3⤵PID:8068
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"3⤵PID:8164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"3⤵PID:2772
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ComDlg32/Analytic"3⤵PID:12276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ComDlg32/Debug"3⤵PID:4080
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Compat-Appraiser/Analytic"3⤵PID:12224
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Compat-Appraiser/Operational"3⤵PID:17812
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Containers-BindFlt/Debug"3⤵PID:12872
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Containers-BindFlt/Operational"3⤵PID:16580
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Containers-Wcifs/Debug"3⤵PID:18400
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Containers-Wcifs/Operational"3⤵PID:18376
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Containers-Wcnfs/Debug"3⤵PID:21468
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Containers-Wcnfs/Operational"3⤵PID:21632
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreApplication/Diagnostic"3⤵PID:21916
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreApplication/Operational"3⤵PID:21972
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreApplication/Tracing"3⤵PID:21440
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"3⤵PID:21612
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"3⤵PID:21696
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreWindow/Analytic"3⤵PID:21284
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CoreWindow/Debug"3⤵PID:21752
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"3⤵
- Clears Windows event logs
PID:22204 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"3⤵PID:24012
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crashdump/Operational"3⤵PID:25828
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-CredUI/Diagnostic"3⤵PID:26052
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"3⤵
- Clears Windows event logs
PID:24448 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-CNG/Analytic"3⤵PID:22692
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"3⤵PID:26204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-DPAPI/Debug"3⤵PID:23832
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-DPAPI/Operational"3⤵PID:24452
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"3⤵PID:26368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-NCrypt/Operational"3⤵PID:18192
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"3⤵PID:25876
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"3⤵PID:1820
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"3⤵PID:26600
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"3⤵PID:23132
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DAL-Provider/Analytic"3⤵PID:21168
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DAL-Provider/Operational"3⤵PID:26616
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DAMM/Diagnostic"3⤵PID:28616
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DCLocator/Debug"3⤵PID:16808
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DDisplay/Analytic"3⤵PID:23672
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DDisplay/Logging"3⤵PID:23968
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DLNA-Namespace/Analytic"3⤵PID:22276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DNS-Client/Operational"3⤵PID:26008
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DSC/Admin"3⤵PID:28656
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DSC/Analytic"3⤵PID:28592
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DSC/Debug"3⤵PID:18784
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DSC/Operational"3⤵
- Clears Windows event logs
PID:21428 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DUI/Diagnostic"3⤵PID:24060
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DUSER/Diagnostic"3⤵PID:24360
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXGI/Analytic"3⤵PID:22088
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXGI/Logging"3⤵PID:17316
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DXP/Analytic"3⤵PID:21484
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Data-Pdf/Debug"3⤵PID:25780
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DataIntegrityScan/Admin"3⤵PID:28656
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"3⤵PID:28660
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"3⤵PID:29056
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"3⤵PID:28984
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"3⤵PID:29232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deduplication/Diagnostic"3⤵PID:30100
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deduplication/Operational"3⤵PID:30816
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deduplication/Performance"3⤵PID:30768
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deduplication/Scrubbing"3⤵PID:34408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Defrag-Core/Debug"3⤵PID:34732
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Deplorch/Analytic"3⤵PID:33516
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"3⤵PID:33640
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic"3⤵
- Clears Windows event logs
PID:33728 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceAssociationService/Performance"3⤵PID:33808
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceConfidence/Analytic"3⤵PID:33100
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceGuard/Operational"3⤵PID:33836
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceGuard/Verbose"3⤵PID:21260
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"3⤵PID:33432
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"3⤵PID:34172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"3⤵PID:34396
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSetupManager/Admin"3⤵PID:34412
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSetupManager/Analytic"3⤵PID:31996
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSetupManager/Debug"3⤵PID:33696
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSetupManager/Operational"3⤵PID:33196
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSync/Analytic"3⤵PID:33420
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceSync/Operational"3⤵PID:33472
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUpdateAgent/Operational"3⤵PID:32580
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUx/Informational"3⤵PID:33876
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DeviceUx/Performance"3⤵PID:21164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Devices-Background/Operational"3⤵PID:26292
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"3⤵PID:34236
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"3⤵PID:34296
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"3⤵PID:34512
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"3⤵PID:3776
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiagCpl/Debug"3⤵PID:21368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"3⤵
- Clears Windows event logs
PID:34528 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"3⤵PID:34740
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"3⤵PID:34784
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"3⤵PID:33552
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"3⤵PID:33116
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"3⤵PID:33112
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"3⤵PID:33860
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"3⤵
- Clears Windows event logs
PID:33856 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"3⤵PID:33596
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"3⤵PID:3060
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"3⤵PID:33696
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"3⤵PID:33280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"3⤵PID:4812
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"3⤵PID:33172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"3⤵
- Clears Windows event logs
PID:33388 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"3⤵PID:34436
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"3⤵PID:37344
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"3⤵PID:37696
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"3⤵PID:37652
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"3⤵PID:37712
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"3⤵PID:37756
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"3⤵PID:37852
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"3⤵PID:37736
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"3⤵
- Clears Windows event logs
PID:36348 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"3⤵PID:37828
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"3⤵PID:36316
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"3⤵PID:36164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D10/Analytic"3⤵PID:36264
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"3⤵
- Clears Windows event logs
PID:36272 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/Analytic"3⤵PID:36324
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/Logging"3⤵PID:36684
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"3⤵PID:37144
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D12/Analytic"3⤵PID:37152
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D12/Logging"3⤵PID:37176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D12/PerfTiming"3⤵PID:37316
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3D9/Analytic"3⤵PID:3444
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Direct3DShaderCache/Default"3⤵PID:37280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectComposition/Diagnostic"3⤵
- Clears Windows event logs
PID:37412 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectManipulation/Diagnostic"3⤵PID:37500
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"3⤵PID:37496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DirectSound/Debug"3⤵PID:37324
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Disk/Operational"3⤵PID:37484
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"3⤵PID:37216
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"3⤵PID:37340
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"3⤵PID:37272
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dism-Api/Analytic"3⤵PID:37268
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"3⤵PID:37604
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dism-Api/InternalAnalytic"3⤵PID:37632
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dism-Cli/Analytic"3⤵PID:34084
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"3⤵PID:38380
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"3⤵PID:38440
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"3⤵PID:38456
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Documents/Performance"3⤵PID:38468
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dot3MM/Diagnostic"3⤵PID:38760
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"3⤵PID:38776
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DucUpdateAgent/Operational"3⤵PID:40692
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dwm-API/Diagnostic"3⤵PID:40728
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dwm-Core/Diagnostic"3⤵
- Clears Windows event logs
PID:40788 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"3⤵PID:40804
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dwm-Redir/Diagnostic"3⤵PID:40820
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"3⤵PID:40836
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl-Admin"3⤵
- Clears Windows event logs
PID:40852 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl-Operational"3⤵PID:40868
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Contention"3⤵PID:40896
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"3⤵PID:40912
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Performance"3⤵PID:40928
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxgKrnl/Power"3⤵
- Clears Windows event logs
PID:40948 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"3⤵PID:33172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EDP-Application-Learning/Admin"3⤵PID:33604
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EDP-Audit-Regular/Admin"3⤵PID:35828
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EDP-Audit-TCB/Admin"3⤵PID:33572
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EFS/Debug"3⤵PID:37308
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ESE/IODiagnose"3⤵PID:40800
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ESE/Operational"3⤵PID:40840
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Analytic"3⤵PID:40920
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Debug"3⤵PID:40944
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapHost/Operational"3⤵PID:36256
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapMethods-RasChap/Operational"3⤵PID:40840
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapMethods-RasTls/Operational"3⤵PID:37796
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapMethods-Sim/Operational"3⤵PID:40932
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EapMethods-Ttls/Operational"3⤵PID:40824
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"3⤵PID:39752
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"3⤵PID:39744
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"3⤵PID:33908
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"3⤵PID:40700
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventCollector/Debug"3⤵
- Clears Windows event logs
PID:39240 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventCollector/Operational"3⤵PID:37568
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"3⤵
- Clears Windows event logs
PID:39744 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog/Analytic"3⤵PID:40760
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-EventLog/Debug"3⤵PID:40864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Analytic"3⤵PID:36112
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Debug"3⤵PID:37148
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FMS/Operational"3⤵PID:36144
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"3⤵PID:37368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"3⤵PID:33324
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FeatureConfiguration/Analytic"3⤵PID:40864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FeatureConfiguration/Operational"3⤵PID:40764
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Catalog/Analytic"3⤵PID:42864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Catalog/Debug"3⤵PID:42704
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"3⤵PID:42860
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"3⤵PID:43204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Core/Analytic"3⤵PID:43172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Core/Debug"3⤵PID:43712
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Core/WHC"3⤵PID:43784
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Engine/Analytic"3⤵PID:43748
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Engine/BackupLog"3⤵PID:43824
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Engine/Debug"3⤵PID:43804
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-EventListener/Analytic"3⤵PID:45212
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-EventListener/Debug"3⤵PID:45580
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Service/Analytic"3⤵PID:44964
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-Service/Debug"3⤵PID:45204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"3⤵PID:43804
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Debug"3⤵PID:47464
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"3⤵PID:48476
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"3⤵PID:47852
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Folder"3⤵PID:48504
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Forwarding/Debug"3⤵PID:49064
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Forwarding/Operational"3⤵PID:48532
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"3⤵PID:45496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GenericRoaming/Admin"3⤵PID:45644
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-GroupPolicy/Operational"3⤵
- Clears Windows event logs
PID:47912 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HAL/Debug"3⤵PID:48624
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenter/Debug"3⤵
- Clears Windows event logs
PID:48848 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenter/Performance"3⤵PID:44076
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"3⤵PID:46032
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HelloForBusiness/Operational"3⤵PID:47796
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Help/Operational"3⤵PID:48068
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:48552
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:48984
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:44944
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:45496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup"3⤵PID:48668
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HomeGroup-ListenerService"3⤵PID:48304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HotspotAuth/Analytic"3⤵PID:47712
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HotspotAuth/Operational"3⤵PID:47956
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HttpService/Log"3⤵PID:49024
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-HttpService/Trace"3⤵PID:45112
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"3⤵PID:45548
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"3⤵PID:49060
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"3⤵PID:47408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"3⤵PID:50688
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"3⤵PID:49664
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"3⤵PID:50472
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"3⤵PID:50184
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"3⤵PID:50552
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"3⤵PID:50580
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-VID-Admin"3⤵PID:50596
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Hyper-V-VID-Analytic"3⤵PID:50972
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IE-SmartScreen"3⤵PID:50800
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IKE/Operational"3⤵PID:50752
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IKEDBG/Debug"3⤵PID:50828
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-Broker/Analytic"3⤵PID:50980
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-CandidateUI/Analytic"3⤵PID:51628
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"3⤵PID:51756
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"3⤵PID:51796
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-JPAPI/Analytic"3⤵PID:51872
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-JPLMP/Analytic"3⤵
- Clears Windows event logs
PID:52848 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-JPPRED/Analytic"3⤵PID:52872
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-JPSetting/Analytic"3⤵PID:52936
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-JPTIP/Analytic"3⤵PID:52948
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-KRAPI/Analytic"3⤵PID:53152
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-KRTIP/Analytic"3⤵PID:53012
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-OEDCompiler/Analytic"3⤵PID:53092
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-TCCORE/Analytic"3⤵
- Clears Windows event logs
PID:52724 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-TCTIP/Analytic"3⤵PID:53136
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IME-TIP/Analytic"3⤵PID:53040
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPNAT/Diagnostic"3⤵PID:53048
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"3⤵PID:53196
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPxlatCfg/Debug"3⤵PID:53600
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IPxlatCfg/Operational"3⤵PID:53988
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IdCtrls/Analytic"3⤵PID:53836
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IdCtrls/Operational"3⤵PID:53668
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"3⤵PID:53864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Input-HIDCLASS-Analytic"3⤵PID:52852
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-InputSwitch/Diagnostic"3⤵PID:53428
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"3⤵PID:53372
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"3⤵PID:53800
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"3⤵PID:53928
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"3⤵PID:54112
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-KdsSvc/Operational"3⤵PID:54140
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kerberos/Operational"3⤵PID:53584
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"3⤵PID:53408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-AppCompat/General"3⤵PID:53420
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-AppCompat/Performance"3⤵
- Clears Windows event logs
PID:49004 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"3⤵PID:53348
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"3⤵PID:53460
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"3⤵
- Clears Windows event logs
PID:54952 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"3⤵PID:54992
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Boot/Operational"3⤵PID:55180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"3⤵PID:55220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"3⤵PID:55232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"3⤵
- Clears Windows event logs
PID:55392 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"3⤵PID:49548
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-File/Analytic"3⤵PID:57104
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-IO/Operational"3⤵PID:57152
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"3⤵PID:57228
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"3⤵PID:57244
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-LiveDump/Analytic"3⤵PID:57260
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-LiveDump/Operational"3⤵PID:57276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"3⤵PID:56344
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"3⤵PID:57104
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"3⤵PID:53120
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Pep/Diagnostic"3⤵PID:52868
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Boot"3⤵PID:53200
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"3⤵PID:52160
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"3⤵PID:52724
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Device"3⤵PID:52980
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Driver"3⤵
- Clears Windows event logs
PID:53004 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-PnP/Driver"3⤵PID:57244
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"3⤵PID:53896
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"3⤵PID:52852
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"3⤵PID:57104
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"3⤵PID:52496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"3⤵PID:52868
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"3⤵PID:53220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"3⤵PID:57280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-Registry/Performance"3⤵PID:53896
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Debug"3⤵PID:49496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"3⤵PID:57104
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Operational"3⤵PID:52496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"3⤵PID:55416
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"3⤵PID:57180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"3⤵
- Clears Windows event logs
PID:57240 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"3⤵PID:55336
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"3⤵PID:57084
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"3⤵PID:57440
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"3⤵PID:57460
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Kernel-XDV/Analytic"3⤵PID:57476
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-KeyboardFilter/Admin"3⤵PID:57492
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-KeyboardFilter/Operational"3⤵
- Clears Windows event logs
PID:59240 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-KeyboardFilter/Performance"3⤵PID:59276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Known"3⤵PID:59400
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-L2NA/Diagnostic"3⤵PID:59468
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LDAP-Client/Debug"3⤵PID:60352
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LSA/Diagnostic"3⤵PID:60368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LSA/Operational"3⤵PID:60384
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LSA/Performance"3⤵PID:59284
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"3⤵PID:59404
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"3⤵PID:4168
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"3⤵PID:61188
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"3⤵PID:61204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LimitsManagement/Diagnostic"3⤵PID:61308
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"3⤵PID:61320
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"3⤵PID:61360
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LiveId/Analytic"3⤵PID:61396
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-LiveId/Operational"3⤵PID:52952
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"3⤵PID:57176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"3⤵PID:53572
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"3⤵PID:57284
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"3⤵PID:52988
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSFTEDIT/Diagnostic"3⤵
- Clears Windows event logs
PID:52164 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Admin"3⤵PID:53208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Debug"3⤵PID:52980
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MSPaint/Diagnostic"3⤵PID:57456
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Admin"3⤵PID:57724
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Analytic"3⤵PID:61256
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Debug"3⤵PID:61204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MUI/Operational"3⤵PID:61316
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Media-Streaming/DMC"3⤵PID:61388
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Media-Streaming/DMR"3⤵PID:61408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Media-Streaming/MDE"3⤵PID:53820
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"3⤵PID:61200
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"3⤵PID:61728
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"3⤵PID:61744
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"3⤵PID:62000
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"3⤵PID:63084
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"3⤵PID:63212
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"3⤵PID:63396
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Minstore/Analytic"3⤵PID:65276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Minstore/Debug"3⤵PID:65316
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"3⤵PID:65376
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"3⤵PID:65424
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic"3⤵PID:65464
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational"3⤵PID:65484
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"3⤵PID:65500
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-MobilityCenter/Performance"3⤵PID:65516
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"3⤵PID:21288
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"3⤵
- Clears Windows event logs
PID:63408 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"3⤵PID:67496
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"3⤵PID:68888
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Mprddm/Operational"3⤵PID:69004
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NCSI/Analytic"3⤵PID:69032
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NCSI/Operational"3⤵PID:69048
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"3⤵PID:69072
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"3⤵PID:69088
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS/Diagnostic"3⤵PID:69104
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NDIS/Operational"3⤵PID:69120
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NTLM/Operational"3⤵PID:69136
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"3⤵PID:69160
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Narrator/Diagnostic"3⤵PID:69180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Ncasvc/Operational"3⤵PID:69308
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"3⤵PID:69336
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NcdAutoSetup/Operational"3⤵PID:69364
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NdisImPlatform/Operational"3⤵PID:69440
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Ndu/Diagnostic"3⤵PID:69492
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetShell/Performance"3⤵PID:69600
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Network-Connection-Broker"3⤵PID:69612
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Network-DataUsage/Analytic"3⤵PID:69624
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Network-Setup/Diagnostic"3⤵PID:67268
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"3⤵PID:67220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkBridge/Diagnostic"3⤵PID:69008
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkLocationWizard/Operational"3⤵PID:69084
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"3⤵PID:65344
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProfile/Operational"3⤵PID:65360
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProvider/Operational"3⤵PID:65408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProvisioning/Analytic"3⤵PID:68968
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkProvisioning/Operational"3⤵PID:68884
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkSecurity/Debug"3⤵PID:69360
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NetworkStatus/Analytic"3⤵PID:69508
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"3⤵PID:69256
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"3⤵PID:69332
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"3⤵PID:70824
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-NlaSvc/Operational"3⤵PID:70836
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Ntfs/Operational"3⤵PID:70976
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Ntfs/Performance"3⤵PID:71124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Ntfs/WHC"3⤵PID:71208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLE/Clipboard-Performance"3⤵PID:71808
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLEACC/Debug"3⤵PID:73464
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"3⤵PID:73476
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"3⤵PID:73488
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"3⤵PID:73584
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"3⤵PID:73692
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"3⤵PID:75444
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"3⤵PID:75740
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OcpUpdateAgent/Operational"3⤵PID:75876
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"3⤵PID:75892
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Debug"3⤵PID:75904
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/Operational"3⤵PID:77248
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"3⤵PID:77340
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OneBackup/Debug"3⤵PID:77356
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OneX/Diagnostic"3⤵
- Clears Windows event logs
PID:77380 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OneX/Operational"3⤵PID:77392
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OobeLdr/Analytic"3⤵PID:77408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-OtpCredentialProvider/Operational"3⤵PID:77424
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PCI/Diagnostic"3⤵PID:77472
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PackageStateRoaming/Analytic"3⤵
- Clears Windows event logs
PID:77488 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PackageStateRoaming/Debug"3⤵PID:77504
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PackageStateRoaming/Operational"3⤵PID:77540
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ParentalControls/Operational"3⤵PID:77628
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Partition/Analytic"3⤵PID:77644
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Partition/Diagnostic"3⤵PID:77664
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"3⤵PID:77684
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PerceptionRuntime/Operational"3⤵PID:77700
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PerceptionSensorDataService/Operational"3⤵PID:77720
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"3⤵PID:77780
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"3⤵PID:77808
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"3⤵PID:75908
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"3⤵
- Clears Windows event logs
PID:77260 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"3⤵PID:65324
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"3⤵
- Clears Windows event logs
PID:69576 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"3⤵PID:68964
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"3⤵PID:78176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"3⤵PID:79604
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"3⤵PID:78176
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PhotoAcq/Analytic"3⤵PID:81776
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PlayToManager/Analytic"3⤵PID:81860
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Policy/Analytic"3⤵PID:81896
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Policy/Operational"3⤵PID:82928
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"3⤵PID:83220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"3⤵PID:83236
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Power-Meter-Polling/Diagnostic"3⤵PID:83296
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"3⤵PID:83312
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"3⤵PID:83376
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"3⤵PID:83600
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"3⤵PID:83620
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"3⤵PID:83892
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"3⤵PID:83904
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Admin"3⤵PID:85068
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Analytic"3⤵
- Clears Windows event logs
PID:85120 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Debug"3⤵
- Clears Windows event logs
PID:85136 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PowerShell/Operational"3⤵
- Clears Windows event logs
PID:85156 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"3⤵PID:85288
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintBRM/Admin"3⤵PID:85304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService-USBMon/Debug"3⤵PID:85484
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Admin"3⤵PID:85524
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Debug"3⤵PID:85680
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PrintService/Operational"3⤵
- Clears Windows event logs
PID:85696 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Privacy-Auditing/Operational"3⤵PID:85756
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ProcessStateManager/Diagnostic"3⤵
- Clears Windows event logs
PID:77424 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"3⤵PID:85172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"3⤵
- Clears Windows event logs
PID:87072 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"3⤵PID:89128
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"3⤵PID:89148
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"3⤵PID:89164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"3⤵PID:89180
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Proximity-Common/Diagnostic"3⤵PID:89236
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Proximity-Common/Informational"3⤵PID:89276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Proximity-Common/Performance"3⤵PID:89300
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PushNotification-Developer/Debug"3⤵PID:89316
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PushNotification-InProc/Debug"3⤵
- Clears Windows event logs
PID:89332 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PushNotification-Platform/Admin"3⤵PID:89348
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PushNotification-Platform/Debug"3⤵PID:89384
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-PushNotification-Platform/Operational"3⤵PID:89400
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"3⤵
- Clears Windows event logs
PID:89588 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"3⤵PID:89708
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"3⤵PID:89888
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC/Debug"3⤵PID:89904
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RPC/EEInfo"3⤵PID:89920
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RRAS/Debug"3⤵PID:89936
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RRAS/Operational"3⤵PID:89952
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RadioManager/Analytic"3⤵PID:89996
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"3⤵PID:89304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RasAgileVpn/Debug"3⤵PID:89320
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RasAgileVpn/Operational"3⤵PID:3104
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReFS/Operational"3⤵PID:89356
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"3⤵PID:91612
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoost/Operational"3⤵PID:92024
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"3⤵PID:92200
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"3⤵PID:93408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Regsvr32/Operational"3⤵PID:93424
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteApp"3⤵PID:93444
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteApp"3⤵PID:93468
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"3⤵PID:93484
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"3⤵PID:93588
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"3⤵PID:93616
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"3⤵PID:93628
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"3⤵PID:94164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"3⤵PID:85320
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin"3⤵PID:94164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug"3⤵PID:94640
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug"3⤵
- Clears Windows event logs
PID:95160 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"3⤵PID:95792
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"3⤵PID:97436
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Operational"3⤵PID:97600
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"3⤵PID:97668
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"3⤵PID:97704
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"3⤵PID:97864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ResourcePublication/Tracing"3⤵PID:98204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RestartManager/Operational"3⤵PID:98216
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RetailDemo/Admin"3⤵PID:98276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-RetailDemo/Operational"3⤵PID:99164
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Graphics/Analytic"3⤵PID:101092
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"3⤵PID:101108
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Networking/Tracing"3⤵PID:101124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Web-Http/Tracing"3⤵PID:101140
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-WebAPI/Tracing"3⤵PID:101156
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"3⤵PID:101172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"3⤵PID:101188
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"3⤵PID:101208
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"3⤵PID:101224
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime/CreateInstance"3⤵PID:101240
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Runtime/Error"3⤵PID:101256
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBClient/Analytic"3⤵PID:101272
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"3⤵PID:101288
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"3⤵PID:101304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBClient/Operational"3⤵PID:101320
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBDirect/Admin"3⤵
- Clears Windows event logs
PID:101104 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBDirect/Debug"3⤵PID:101124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBDirect/Netmon"3⤵PID:101168
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Analytic"3⤵PID:101184
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Audit"3⤵PID:101204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Connectivity"3⤵PID:101192
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Diagnostic"3⤵PID:103128
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Operational"3⤵PID:104368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Performance"3⤵PID:104844
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBServer/Security"3⤵PID:105460
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBWitnessClient/Admin"3⤵PID:99788
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SMBWitnessClient/Informational"3⤵PID:97672
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SPB-ClassExtension/Analytic"3⤵PID:101688
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SPB-HIDI2C/Analytic"3⤵PID:107736
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Schannel-Events/Perf"3⤵PID:109220
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sdbus/Analytic"3⤵PID:109324
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sdbus/Debug"3⤵PID:109380
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sdstor/Analytic"3⤵PID:109480
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Search-Core/Diagnostic"3⤵PID:107740
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"3⤵PID:109232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SearchUI/Diagnostic"3⤵PID:107720
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SearchUI/Operational"3⤵PID:109204
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SecureAssessment/Operational"3⤵PID:107716
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Adminless/Operational"3⤵PID:109236
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"3⤵PID:107716
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"3⤵
- Clears Windows event logs
PID:109620 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"3⤵PID:111620
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"3⤵PID:113596
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"3⤵PID:113660
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-IdentityListener/Operational"3⤵PID:107336
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-IdentityStore/Performance"3⤵PID:113564
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"3⤵PID:101184
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Mitigations/KernelMode"3⤵
- Clears Windows event logs
PID:113576 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Mitigations/UserMode"3⤵PID:113872
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Netlogon/Operational"3⤵PID:114888
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"3⤵PID:110344
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"3⤵PID:116040
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"3⤵
- Clears Windows event logs
PID:117076 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP-UX/Analytic"3⤵PID:117120
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-SPP/Perf"3⤵PID:117192
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"3⤵PID:117232
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Security-Vault/Performance"3⤵PID:117248
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"3⤵PID:117264
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"3⤵PID:117452
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"3⤵PID:121404
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SendTo/Diagnostic"3⤵PID:121568
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sens/Debug"3⤵PID:121680
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sensors/Debug"3⤵PID:121700
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Sensors/Performance"3⤵PID:121844
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"3⤵PID:120336
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Serial-ClassExtension/Analytic"3⤵PID:121420
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ServiceReportingApi/Debug"3⤵PID:121432
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Services-Svchost/Diagnostic"3⤵PID:114872
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Services/Diagnostic"3⤵PID:114884
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Servicing/Debug"3⤵PID:111320
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync-Azure/Debug"3⤵PID:115960
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync-Azure/Operational"3⤵PID:114864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync-OneDrive/Analytic"3⤵PID:122392
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync-OneDrive/Debug"3⤵PID:122408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync-OneDrive/Operational"3⤵
- Clears Windows event logs
PID:123340 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync/Analytic"3⤵PID:123632
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync/Debug"3⤵PID:123652
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync/Operational"3⤵PID:124016
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SettingSync/VerboseDebug"3⤵PID:124196
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Setup/Analytic"3⤵PID:125196
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupCl/Analytic"3⤵PID:125228
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupPlatform/Analytic"3⤵PID:125264
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupQueue/Analytic"3⤵PID:125352
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SetupUGC/Analytic"3⤵PID:125368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"3⤵PID:125380
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"3⤵PID:125392
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"3⤵PID:125408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"3⤵PID:125424
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"3⤵PID:125440
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"3⤵PID:125452
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"3⤵PID:125468
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"3⤵PID:125568
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"3⤵PID:125584
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"3⤵PID:125600
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/ActionCenter"3⤵PID:126740
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/AppDefaults"3⤵
- Clears Windows event logs
PID:128372 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/Diagnostic"3⤵PID:129524
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"3⤵PID:129636
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Core/Operational"3⤵PID:129756
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"3⤵PID:128456
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"3⤵PID:123648
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"3⤵PID:121724
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-Shwebsvc"3⤵PID:117156
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"3⤵PID:130404
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"3⤵PID:130420
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"3⤵PID:130440
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Shsvcs/Diagnostic"3⤵PID:133256
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SleepStudy/Diagnostic"3⤵PID:133388
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmartCard-Audit/Authentication"3⤵PID:133408
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"3⤵PID:133504
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"3⤵
- Clears Windows event logs
PID:133580 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"3⤵PID:133704
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmartScreen/Debug"3⤵PID:133980
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmbClient/Audit"3⤵PID:134004
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmbClient/Connectivity"3⤵PID:135720
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmbClient/Diagnostic"3⤵PID:136160
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SmbClient/Security"3⤵PID:136172
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"3⤵PID:137640
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Spell-Checking/Analytic"3⤵PID:133556
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SpellChecker/Analytic"3⤵PID:139280
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Spellchecking-Host/Analytic"3⤵PID:139296
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SruMon/Diagnostic"3⤵PID:133636
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-SrumTelemetry"3⤵
- Clears Windows event logs
PID:140268 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StateRepository/Debug"3⤵PID:141276
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StateRepository/Diagnostic"3⤵PID:137460
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StateRepository/Operational"3⤵PID:137816
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StateRepository/Restricted"3⤵PID:137612
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StorDiag/Operational"3⤵PID:137820
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-StorPort/Operational"3⤵PID:137636
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ATAPort/Admin"3⤵PID:141356
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ATAPort/Analytic"3⤵PID:141380
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ATAPort/Debug"3⤵PID:141696
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ATAPort/Diagnose"3⤵PID:141728
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ATAPort/Operational"3⤵
- Clears Windows event logs
PID:142180 -
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ClassPnP/Admin"3⤵PID:143108
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ClassPnP/Analytic"3⤵PID:143124
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ClassPnP/Debug"3⤵PID:143864
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"3⤵PID:144284
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-ClassPnP/Operational"3⤵PID:144304
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Disk/Admin"3⤵PID:145368
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Disk/Analytic"3⤵PID:145384
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Disk/Debug"3⤵PID:145400
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Disk/Diagnose"3⤵PID:141352
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Disk/Operational"3⤵PID:141720
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Storport/Admin"3⤵PID:138236
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Storport/Analytic"3⤵PID:145372
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Storport/Debug"3⤵PID:145404
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Storport/Diagnose"3⤵PID:144492
-
C:\Windows\system32\wevtutil.exewevtutil cl "Microsoft-Windows-Storage-Storport/Health"3⤵PID:145412
-
\??\c:\Windows\system32\vssadmin.exe"c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:2364 -
\??\c:\windows\system32\cmd.exe"c:\windows\system32\cmd.exe" /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c2⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\system32\powercfg.exepowercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Suspicious use of AdjustPrivilegeToken
PID:8164 -
\??\c:\windows\system32\schtasks.exe"\\?\c:\windows\system32\schtasks.exe" /create /xml "C:\Windows\TEMP\config50.xml" /tn "\Microsoft\Windows\Task Manager\Task Manager"2⤵
- Creates scheduled task(s)
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe"C:\Users\Admin\AppData\Local\Temp\5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130.exe" -takescreenshot2⤵PID:296
-
\??\c:\windows\system32\sc.exe"c:\windows\system32\sc.exe" delete defser2⤵
- Launches sc.exe
PID:53652 -
\??\c:\Windows\system32\vssadmin.exe"c:\Windows\system32\vssadmin.exe" Delete Shadows /All /Quiet2⤵
- Interacts with shadow copies
PID:52928 -
\??\c:\windows\system32\wbadmin.exe"c:\windows\system32\wbadmin.exe" delete catalog -quiet2⤵
- Deletes backup catalog
PID:53552 -
\??\c:\Windows\System32\wbem\WMIC.exe"c:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:55204
-
\??\c:\Windows\System32\cmd.exe"c:\Windows\System32\cmd.exe" /c del /S /Q /F c:\windows\temp\2⤵PID:51872
-
\??\c:\windows\sdelete.exe"c:\windows\sdelete.exe" -nobanner -z f: c:2⤵PID:51972
-
\??\c:\windows\taskmgr.exec:\windows\taskmgr.exe 191⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:8036 -
\??\c:\windows\taskmgr.exe"c:\windows\taskmgr.exe" 172⤵
- Executes dropped EXE
PID:284
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:8048
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:22212
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:21364
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:22612
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:25820
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:28628
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:24048
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:21168
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:33524
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:28636
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:33376
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
PID:37204
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:36244
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:36256
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:42584
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:44108
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:47648
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:45424
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:45920
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:47096
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:52728
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:53148
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:54056
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:54944
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:55056
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:55328
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:55368
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:52976
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:58808
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:61224
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:60348
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:61188
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:67156
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:69200
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:69520
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:65408
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:71228
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:77268
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:77740
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:69180
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:83928
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:85352
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:85324
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:89200
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:89436
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:93500
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:94136
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:95196
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:97844
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:101340
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:101332
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:104368
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:107312
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:109244
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:101304
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:107716
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:114812
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:117136
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:117396
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:121720
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:124056
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:125284
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:129544
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:132020
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:133284
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:134500
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:137296
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:140200
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:141260
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:145396
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Indicator Removal
4File Deletion
3Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
Filesize
831B
MD536fbc33e68ed5e5cd90bddd228909ee1
SHA14a026f1b46e230805a5ab4a6fb2b3389789e146d
SHA2569cfae17d8802cbf1425988d6f07435e3d287f9ce4054e6aa9e8fff7023fe3c93
SHA512cf778fdf3727ff00e2d7ac22f11b88ed7cd284d8caea4a79c850351d25ea0f0908735200bc1791e18fa633cdd428b6519fef00d40e798707fda8dc1d0b4e4360
-
Filesize
601B
MD5a22833e8f41d921cf1f79df4ec11e399
SHA1e9f3a34de3e9ac2e31492732a3509c38582ee8f4
SHA25627509dfb939a607dc1e400e00a3ba7876a2858e97037a26663e8f283dc012a88
SHA512e1a6bdddc9b8e3d41dc2797f7af858519f0a46de7f04a3e23178db2aa5455fcc3849b39fee466e5df5e2e6e7b9ee326f3b72cf77e0a982a38ba51a72d1a1cca0
-
Filesize
840B
MD5ceb4a3619ca99344ec0499e31a1d6416
SHA15fc26e691edfb370ae92189005abb27c386f3b68
SHA25621c6d3117fa7d2a85bf192aa7bd3077d18bf4708ee7aefb3d5fc082912bbc793
SHA5124e654e55f6a2ac16f88120de154cd8252f72694d0ac43f41a4d8a7990358abf3c9d34e861ac4ba9f828d114c651df4ba72a2d41e28746ec6cc549b6cb8be82f9
-
Filesize
765B
MD580a7a24cd999612a337a5440431e2904
SHA100921192c0c423d5ffec10c2744a8435729b2282
SHA256678c82ceda043c83d2bd2706ba01db5030044a7fb766b3921b67822bade07788
SHA5128e5710864cee12b5c772ffce19384fee21e7100a986dbc5f54009ae3b477d24b841095b10ffe730044fb8db5111d58b440337b42cdff1c521ed2cef62d14d967
-
Filesize
769B
MD5dee5e901462a738c43b8215f44e7f3eb
SHA137b74139340f72c71acb5da7bab61fc2db2eeb4f
SHA256b704a59a66bc8beb1c397fc16acd8995f990bd1227f96671dd0a8d0339b58c0a
SHA512bc4b340ab8074b6e62d3f29ad3b17a228ccedcf10cc0108b3b4c351a5a74e9bd719e1567046a9181fe9a9cd223e5a5540e93625459ba144eda41040dcecd9d1f
-
Filesize
771B
MD59ac2f4174ba6818c50d4c02a1b97a1bd
SHA151c3861d9b1557f6ec4e5d3edbf92f2c0cfcadcf
SHA256f77c03c4a679050fbe046b35ec568015a93c33584bda83fc9203ba5ac5d3c2e1
SHA512dcbce1c064339c73e4af29866a4e14c36b1baf56305fa70708045cb7ebe2f76039535244ba5e2d90510839ddb0005dddcbee31ed56d7d7246ad2496a7903710b
-
Filesize
769B
MD5cdcc26429f3adb8ead7bac8c78e2fb3e
SHA193a98eb3d5234a7f8b1e3a553d29fc29d812be41
SHA2563e4cfa260678478d7996c3a9e09da57d08ba20103ae2c8f29fd3e62cbeb9fc88
SHA512ed8d6aa2eb76423dc6fa82121c693e82d0c6d8a72b091559cab1e5b5992a65978b72b75a00cc9524d42710fa39270425f25302996c40100ee72d9edccd8263c7
-
Filesize
984B
MD5c7749f51c529aa30ee96c722d3f6a971
SHA1d0ec83e75a991ed391a45b8f6c9fc38261f1f49c
SHA2568af8bc07ffbb747510d16c172c21e4411d16deda65ce4a68ab470cbc7774f8eb
SHA5123d8596deffc4cbfb3dd6bf969e8ca0270eb2b931ce838aaee36b365b5261eba0f1d81802ecc5a23e72274119b48c08776f063e8a8d204f885e200bb1377d6787
-
Filesize
986B
MD5106ecf8e99648728b0c1f23ad500c7d3
SHA138cb896426b79626faaf90c36c7de3066affa447
SHA256d9b1b199648f5f25d8f8854c85a096fc1ba8e001292bab5115095ebbc3d8d158
SHA512da873db69f279fa72792a67985ff99feab305ce8e09325c5d5450269ef79c92ba4781ffe6d73aa9f558433baed8756a0f37c430507530292dd58978f20b4c97a
-
Filesize
601B
MD51db99e180aa21f0efa8f9444a55f35db
SHA18114492d304106771d2f372c652685fb62de3d1c
SHA256b3add08e6db52a3a21649dcacb069ba320ef5df1fc1374228e023fb499b5bf43
SHA5121db6d05c5f286e3b6826274a8f5b4b886cfacd2b3d43fdb78564ab199044b4b4fa14cd608f3f7f2472e59d0b8e30ef63d6fac63711d88d3073161df334b5c5de
-
Filesize
797B
MD590e3172dc33cfd4a303d7c617979ba27
SHA15ca746ad347cfb5d5626beea28ce7fdcd6968a09
SHA256c0cfb2512e67d99c4d601942426bd99aadccfa5944abbbde166e691e62a5e2fd
SHA512a8b688bb52745d2ed481ce683e3bfab2b75082cb353bd0e6b14981760e6506e8a1ad83cca1cc50f745772d09e339644aa5b2dc597071556d78ecde6df6ef2fc6
-
Filesize
512B
MD57e0e1de2a6fd4d504a987f8e1bb9ad1b
SHA15fdb4303f7b9ce5b9bdf8b772930f4dde030a258
SHA256fd987ff4acfdbab9284d6530b86c33c02e5bf2afa1aec9a65276777e023b69a6
SHA512540cb84aa29b1d705a8ce97a9f2cb6e911b672427340a033b2a2bd87d3bd2975aa72f3c8724f77f231ae758efbf9460ccae4dba60302cdf92bc0811b18939a30
-
Filesize
1KB
MD52cb962ec7c0481e93ba833c37c014dd4
SHA153160aa1fa28efc1ec657a74bfb3a14a0d5358d5
SHA2566b296f2bbe24d52db579f4f4e9ae9fa3e0549e1d3adceadd3ae1439ee7d1dc95
SHA512318da844994731fe5e18e460a44840151278da36499c5ac251354e9362e159966e4996eaf5162b5b6096832bc3058bbc4253d5292201417ec585b528480b9397
-
Filesize
3KB
MD55436352cf1a1a3d06eafe09d851d28ab
SHA182c93eefbc1cc4a5d3a1aec5507b3ae4eeb14817
SHA25647ce9b1b82726b13654d65fb44c961896f9f70542066c4d1e2b5a5d192c13486
SHA512eb1b3481c1ae6bd5131a5cac274cf4a0bf57fc4fca54ff4128acd5e26665ef001390f71d08b249279386b22e2773d3ef44958122c41b146c1ab8384be792260b
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.url
Filesize620B
MD540f64351693bfad02c4c36ef95a43c65
SHA1e88291141fe3e0ff3fef8fe80547f40a674ef9ac
SHA256d49becc211a378976c78e6942582f424d5ceccf79c96959744c3379e56be0a0a
SHA5127f0f7bab3206c5dcf4e1513993cd40011b0673f737310b5f89b21864655cddd36429a7db0f11b76e2458606cddc1db415b9521f54392b1b96227d92e650b8d7a
-
Filesize
604B
MD533ce3fb30bc463f22fb50fe9bcd850f5
SHA1335d5c765e44b73fb36f89a70270ed52186e20ba
SHA25677840703465b9a2c5dd34d7f6a4cc8f4777380c53181a169920704bc160c5726
SHA51279c13a49f84ef8138672bae792a237f72d44545cb7302c38ca5ad004566a91c70f7b71b12b71f41633c3f741f2a1af4a53d5dee75b659815eb35915958aa5213
-
Filesize
600B
MD5f1a1692e6fc83ab530c3e9553b56c3f6
SHA1ac8d25b89d3ad83c868cdd87e034a27b8bc7e820
SHA256e72c176c8f40b096482baaf0c8c02cd9f482fb7d3645c216dd409c66987ac7d6
SHA512daa3f9b5090d4ad14518e00ed54c300920875029454c3279da8ae0121537350b1ed619db045ae09e439aef5b18105004ecf79bc1b380c20efa884936fa104636
-
Filesize
601B
MD540a86ecd1a493645d50842e76ef2b6b3
SHA174d7b4c854f2aa8db8ef8a86ea9f5da142cc8d62
SHA25604a12265b9ffc0c7da82f388b6e2a405d269ca9b0b5b5ef7d1e30ced54f82daa
SHA512fecad5915204b63f4bf93a05a36c83f6d9f2851740bb52ac19700bdb27a49eb36dde398d3d82e59cd78ae91792d2dbd5245f824cb19d999f4342f9fc24bb1e50
-
Filesize
765B
MD5990e97cf8c5d7bdc100c65ff257b1162
SHA1ea7eb7532035e5cd05c5d7269c656f7a0ab34dc4
SHA256bf86fb0c33d52c3362a6df163193fe14d22011053c7cac61fe42cab2119e30c7
SHA5125081024d8092da62e102326e6cffd6dd85fc019608b9ce0adf0d169a140dd409b8be0b8396a74861a881a198309a20b92f920df7215f5e87e53b9625c86c06fe
-
Filesize
645B
MD5e19b8c54ef35da539ff2df3370ab11c8
SHA14a81388fe4c2d2cdb15fe3d9b429825c38e657de
SHA256d6ae61afd4cb08957516d41c8078f9f44c1e6a218a7f5e0d6ebd87199444c328
SHA512e4c2b246a0f9508a281f13c050da4747d50a432b47800db72660fb1b16f0bd36ae77201396d33b62e22ad02ba28ebc26e778e153cd3ce59913d95f85703139d7
-
Filesize
827B
MD57d2bc498a1ba4e4fc03bbd3eeaf6e248
SHA1ab4abfbe70ec513e5e66f330cdd1ca024ef5044e
SHA2561ee7bf9fe0af6bb9976f4debe2ed183b6843fa5883a9cc4d88097887d0333e38
SHA512d0a051428eb52dc737f13c568ccef8e85e963c3e0621ce44bb4b9c28f779b3413d4d37efbddb88b6189c85a78f3ec2e5b39a06211f55f0001aa1d4d3ba0472bb
-
Filesize
601B
MD5b827123998a09e87632f11f0fe98b7ca
SHA1115336a99f048f51001efca200c2eee30301c3f3
SHA2568384c154729e10141d5c7c735ff24402c28ed95d8557a96077bb548622d45ba6
SHA5122ac12599a71c944f91d034dde73b2ac7c0575ede5b0943ae986ab93248fd17351472f8bf0c0a394bd778b38dfd5b4bc803bb71f8b8a286c825f6b82a23404dc7
-
Filesize
21B
MD5ae5b870422a894681852149c70f30f81
SHA104f0b227483c14af01f7401cdf9658878e5edfe7
SHA2560658d38ddff34224da386c983352798cc4770351b7ce80879beb7b601adc26d8
SHA512d0ba1e149fd1b708890c4033f2015a3b3b273427984ef9ee462f697d7ce5186a102448bd282560fd2a0fe49f0f72a9408366b86f36979d0f54db373d38dde811
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
Filesize
16KB
MD57b6a80e9b6c3bb1dfb23cd83a87cbd63
SHA106fe9ef69253cf6976a01fd46786ba178b0bc125
SHA256eeff8c61baaa8e97aa4f2af66a27d814bb588b1cc4c2395146e84addb9077f89
SHA51291035ccaad97c19fbcbbfd9e3d5b90abc7840d1d7109bdd47626d1ffee93a45fe985a2ceca325c00927e40da56a0313fb991f6a9f2a3551530e12d72302c3b08
-
Filesize
16KB
MD5f020a763639fcbf6217516c0a6864c81
SHA16e10e0dd34114a676c6e7e7add0bd216f115671a
SHA256bd70a2a3fce9798792b76c09e385b4123cf800786bc3ab86f67cdbee1f54718f
SHA512e894847991d58358f97f06ce2bb9c0b1c1029af537ddc8c11dd76c1af6496bff28fe9f0f14333c65d8d6b944e432ecca586c6ae8a8cb9d667da838ec4dd5a92d
-
Filesize
1024KB
MD5f5fef41e3d9b7053177844b3f94d8b61
SHA1c0c6384f2e0b56c6ac0b999d8584a2bc9509d20e
SHA25668431ab4b4a76a1a635df107e402a68d272c88729c157e5de0fbdf84523b879e
SHA5127039fbe40f264b4a79df4219fbee8952ad0d05a2501cf9ca5cfd28adc86558dc6df1a2568e486d06b6f50566f1ce74b7b9d0796891b5d1dbabcf077fa7dbd885
-
Filesize
7KB
MD5e342f339c251a79743ed175f3cb21856
SHA1f6a07d6b153a80787f4c554012ae7cf9226bdb29
SHA256ce54b9c530ea7c3baebbc23880879425c0337f59c7c2e9964659c52013b8c629
SHA5121ff48a5734ff18fe64ea2e3f0496694f5c08cd13b9291e60f4edf8ef1dfca3513f6d8cec9ebe3f2c71831f3aab9881ab4c05761dc5b353951899fca6f41260ad
-
Filesize
451B
MD584e9d3f4e7a117c2227338cc15f35643
SHA1e35424dba3a9f2d6afc3e88c68fbc24aec39d384
SHA25688ebd9275636ddba1e3b4e27c01685f38d87607c6d9e524d79d704415f31afb3
SHA512143ae74f3197279bfccb32f14194a1442467f04672b5da49f0832abb10936829e32d596067616b6c9d8a967bac3e93c07c6a7e70c30d48d00a4bfe86da35f78a
-
Filesize
24B
MD52dd3f3c33e7100ec0d4dbbca9774b044
SHA1b254d47f2b9769f13b033cae2b0571d68d42e5eb
SHA2565a00cc998e0d0285b729964afd20618cbaecfa7791fecdb843b535491a83ae21
SHA512c719d8c54a3a749a41b8fc430405db7fcde829c150f27c89015793ca06018ad9d6833f20ab7e0cfda99e16322b52a19c080e8c618f996fc8923488819e6e14bb
-
Filesize
24B
MD5419a089e66b9e18ada06c459b000cb4d
SHA1ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a
SHA256c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424
SHA512bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c
-
Filesize
1024KB
MD54e68285458aab0798bbb851424e818ee
SHA13d882fe1298f44e5a86323bc2596a7f94ada2baf
SHA256ee2aa3b794f8f079b81f0567917b4a0ccd25072c324b2517665298ee7d5e2c80
SHA512bd100940ff0e02e42f0d2d25eb017ccd57850a9ddd3d331da8a141c22815771a87442fe510755d718cda01129c34adfd1d49e84f467d9defccc3daf41b0f135d
-
Filesize
451B
MD501210fa57bda63e6ce437799f1e5acd1
SHA11ace11fb381122de17ca9df12d2d6373c4db9725
SHA256e2033f5f18ff788f6e4adb2c7752ac5897a16aae759ef6cbdbb4aefe8b289309
SHA512706ad08aa3d7f4f4848aa7bc7ce50e509a06e82131ad10c432bd543e17a7d864408495664ce8d02fbdb6fd0ace2a8458c2a5440577b9be448fa735ecc62b95b1
-
Filesize
24B
MD5635e15cb045ff4cf0e6a31c827225767
SHA1f1eaaa628678441481309261fabc9d155c0dd6cb
SHA25667219e5ad98a31e8fa8593323cd2024c1ca54d65985d895e8830ae356c7bdf1d
SHA51281172ae72153b24391c19556982a316e16e638f5322b11569d76b28e154250d0d2f31e83e9e832180e34add0d63b24d36dd8a0cee80e8b46d96639bff811fa58
-
Filesize
24B
MD5f6b463be7b50f3cc5d911b76002a6b36
SHA1c94920d1e0207b0f53d623a96f48d635314924d2
SHA25616e4d1b41517b48ce562349e3895013c6d6a0df4fcffc2da752498e33c4d9078
SHA5124d155dfedd3d44edfbbe7ac84d3e81141d4bb665399c2a5cf01605c24bd12e6faf87bb5b666ea392e1b246005dfabde2208ed515cd612d34bac7f965fd6cc57e
-
Filesize
451B
MD5c2c241685622f29453198a51df8e9452
SHA19b20f46092dbc09d8ed9be36d9823017f7eb3996
SHA25621cfb5f8d6542e363c111ec9fe23a4745120c57921d8a24553ed11eab36f7106
SHA5127c8e34c2442f06932ceac50b4e3caac73027aefff18610988430aa7f8c4660ee974584728b70083b38dc4d439bab86d6bce08853b7088a4c0152eb528d452395
-
Filesize
24B
MD52d84ad5cfdf57bd4e3656bcfd9a864ea
SHA1b7b82e72891e16d837a54f94960f9b3c83dc5552
SHA256d241584a3fd4a91976fafd5ec427e88f6e60998954dec39e388af88316af3552
SHA5120d9bc1ee51a4fb91b24e37f85afbf88376c88345483d686c6cff84066544287c98534aa701d7d4d52e53f10a3bea73ee8bc38d18425fde6d66352f8b76c0cbb5
-
Filesize
24B
MD560476a101249aedff09a43e047040191
SHA1de5b6a0adc7de7180e19286cf0f13567278cdb64
SHA25635bc77a06bfdde8c8f3a474c88520262b88c7b8992ee6b2d5cf41dddc77a83fb
SHA512f1d2dcc562a36434c6c6405ec4eac7ecfa76fc5a940114da6f94495b77584a132d5d82ad3556df749490be096cfd238fa8b484b7c734cbc4d074e963e5d451f4
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
24B
MD5d192f7c343602d02e3e020807707006e
SHA182259c6cb5b1f31cc2079a083bc93c726bfc4fbf
SHA256bb4d233c90bdbee6ef83e40bff1149ea884efa790b3bef496164df6f90297c48
SHA512aec90cf52646b5b0ef00ceb2a8d739befe456d08551c031e8dec6e1f549a6535c1870adb62eec0a292787ae6a7876388dd1b2c884cba8cc6e2d7993790102f43
-
Filesize
24B
MD52a8875d2af46255db8324aad9687d0b7
SHA17a066fa7b69fb5450c26a1718b79ad27a9021ca9
SHA25654097cccae0cfce5608466ba5a5ca2a3dfeac536964eec532540f3b837f5a7c7
SHA5122c39f05a4dffd30800bb7fbb3ff2018cf4cc96398460b7492f05ce6afd59079fd6e3eb7c4f8384a35a954a22b4934c162a38534ad76cfb2fd772bcf10e211f7c
-
Filesize
451B
MD52ec05411f553384bf7a533c3fed50813
SHA1b840fe4f072fb75403c57ce449614b3e486aae61
SHA25613973a7246f14d7db76891910ffa6175527aff8b8cf28099d664dbd382f5d29f
SHA512bb597602d503098274b4f7667ef84dd1f7e65214b7595a49800579944bf41603b6bc635f4ff07eb5bfbd6effb0ceb971f0fc522793327d79e253817241bdf176
-
Filesize
24B
MD5f732bf1006b6529cffba2b9f50c4b07f
SHA1d3e8d4af812bbc4f4013c53c4ffab992d1d714e3
SHA25677739084a27cb320f208ac1927d3d9c3cac42748dbdf6229684ef18352d95067
SHA512064d56217aeb2980a3bfaa1e252404613624d600c3a08b5cf0adcb259596a1c60ee903fdc2650972785e5ae9b7b51890ded01ec4da7b4de94ebda08aeaf662df
-
Filesize
451B
MD57a25f9b917488d6cd4f8fd23eb2e82a2
SHA17e28ec5c5a8262a43c9681ee8f8f3f350bb7c5ae
SHA2567b07bf5aa6fd31c7073a59639108a15a0c1f2544f81426ed5e5bc09d5ca3c08c
SHA5127eb6a9f0b01d1b159db5b2ddf4b4a43c52fb1ef73bbcf8f10a047f6de77fbb2180fb7c0ffa53de4f9cad93a9b1421232d07626d0f17cbee26743c2a89c4aa439
-
Filesize
24B
MD5fc94fe7bd3975e75cefad79f5908f7b3
SHA178e7da8d08e8898e956521d3b1babbf6524e1dca
SHA256ee1ed3b49720b22d5fda63d3c46d62a96ca8838c76ab2d2f580b1e7745521aa5
SHA5124ceaf9021b30734f4ce8b4d4a057539472e68c0add199cf9c3d1c1c95320da3884caf46943fc9f7281607ab7fa6476027860ebed8bbaa9c44b3f4056b5e074d3
-
Filesize
7KB
MD53ae2501239269174f06c5c53ec401dde
SHA1e974aece0666c9e42cd77b73232aaa2205c6cb74
SHA2563b2727401cf5f9cceddc5489a0fde7fa0f72cddea6e4e67a1dc2a6b3f4bafca4
SHA512a9210ada30bc2755a4c8b5b4b3750733327f762ca3b999c23693c2539dce01120a6beaecd750dbabe6ce90fdb0b7b0506677dbcbc1fa5f6d9f7cd94c70ba3550
-
Filesize
14KB
MD5420b95498e70169d555aa2a7e8bc90f1
SHA17b4eeb158085bb243f88b9c7646b261f0ca0cb14
SHA256296450d6b852869f5c989fde8bf8bd2036b01558749879668d5fe3c5fd1d9c78
SHA5120f533e9f415129b407a65280832a617492103b538d0ba4330e0dbf071ac55a8196d244ebe39d0134c366ea4f02ce627bc5525a6b8a1f9512a3cb2656445a8b5f
-
Filesize
7KB
MD51566d405075987a4cc0ca1fe98a217a8
SHA11913860c6ed865ee2ecb7a3be0003acaba44f1ba
SHA25664a925b0ac24de360b14abdeaad9878ca283bc7d11d6e02b36395393640096d0
SHA5123ca9e4debbe94e536c74008f1073d6ff55bd7222ea98b137d110617beb7c440733fc69d59d48676d55b8731f29d08bc5b59a9ca5564eb84bdd8b19b5c4030e99
-
Filesize
451B
MD5374973740e348fe4b0c02af7aebcf443
SHA1057de42d3028a77f0012ba26face61bceabbc51d
SHA2568362bc79d2d3496ab6a1e32cc04c6f8a75a426d4dc6cd7935eb52aa1f86e1b10
SHA5127307279117480265eaa0fbd979a40cd2fcb91a4ba35d111cf0f781d9f134692c1cab3d16e17eb7df284cf0cfb3938726717e2869cfae8586bad6518fd97af9d2
-
Filesize
24B
MD5379523b9f5d5b954e719b664846dbf8f
SHA1930823ec80b85edd22baf555cad21cdf48f066aa
SHA2563c9002caedf0c007134a7e632c72588945a4892b6d7ad3977224a6a5a7457bf4
SHA512eca44de86bbc3309fa6eab400154d123dcd97dc1db79554ce58ce2426854197e2365f5eee42bac6e6e9455561b206f592e159ef82faf229212864894e6021e98
-
Filesize
451B
MD5b171235f32296dc95bf8ca0936b4b681
SHA12f3fb1447216e3a1d73d47b124482f89d50ea015
SHA256af04149a3a9997579a0953793000ff2f93f4c2e5ce8f662c753267e905021f58
SHA512b366882df6c6ce2eb934c68d9650b14644d8455b4d4a0ba6c5f979445e7b86a72d2e6e2aafeff6d856186eace2cf67554a7e23ddba9e4c85b9c4173c5c7d40f9
-
Filesize
24B
MD55f243bf7cc0a348b6d31460a91173e71
SHA15696b34625f027ec01765fc2be49efcfd882bf8e
SHA2561b1aed169f2acfae4cf230701bda91229cb582ff2ce29a413c5b8fe3b890d289
SHA5129e08dfbbf20668b86df696a0d5969e04e6ee4a67e997ff392099bc7ff184b1b8965502215744be7fe423668b69099242bba54df3f0bfe4e70acdc7cad8195b02
-
Filesize
451B
MD5b14d051e706063ccb2e1422ac9083e87
SHA16ea9a47f9dbadb18678ae66ef216054fa4d8d249
SHA2568d953b90f157e1d04ad3028a0225294c98bfc57aa32ec6fbf8845d5fa517d313
SHA5121e30110c267c69c8c907a9edc8a3f33b59fdb69d30f5fdb316cec01e8486ecaf72f9130cdf0cabe12e15bcba90b5906f75f8d3224c77113c8ecc6fe890ad6146
-
Filesize
24B
MD5db7c049e5e4e336d76d5a744c28c54c8
SHA1a4db9c8586b9e4fa24416eb0d00f06a9ebd16b02
SHA256e8830e7ac4088cf3dd464caec33a0035d966a7de5ae4efc3580d59a41916ff7b
SHA512b614037fb1c7d19d704bf15f355672114d25080223e7ee4424ad2cb7b89782219e7877b373bbc7fa44f3ad8df8a27eef4e8ccc765d44ec02a61e3b7fae88ae69
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\AEFT1ZA9\microsoft.windows[1].xml
Filesize95B
MD54f95f1cf0e3fb86c6f095b90fb9da4d1
SHA1ead22989513ac937b3df6a4611261e7c42d629ed
SHA256c47bdb6b0b0338ef7581fe970227ea4be6963c7009cee02bdf3938eeac8185c6
SHA5126bd901aa644b5e3fa952abbcc909f43842ecc1a1bd25e0299332aa3d4c8e582201fdbb03ef06987306336ae827e7d6daa0c7dcbd20cb0b510f0bfdad170948ba
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\EYL17QD1\microsoft.windows[1].xml
Filesize96B
MD502d6189a2ff6530fa8f6d9974b5c04df
SHA15263edc7da9f10cac719621f777c7156e2ff15d6
SHA25603509eeed603de7959807c46de1406d2a2cbd63a8c8ead187b38afff123cfa8f
SHA5122fc34b219dc93e4598580d89ba0ff21b0216c31a40a50260e969d936fd0a724906367c87d45797a562d83da680d14a10186f0ca85d803cb65ad0ff0fb4ebab02
-
Filesize
5KB
MD500e5fcfd833151f7cbde607e2f7afeb4
SHA155839875c0947aafebff53d22ccc5dad29fe3563
SHA256b80192aaabe007baecd0603e3ce183e9d554b8a6b0411d20716acfa086ae3035
SHA512f056777a1987c3becdc217bdc2d82e6aa41086d38fddaa45c42f1726b6f7b7616a10918081650e825a724464ef148b669bc258d38a62e0de8642e2607a0b0de7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
Filesize510B
MD51fc90c4f3ad15694f6880d8c06cf3fdd
SHA1cbb27abcf4bf436e4b348a6de75d3eeccde66f15
SHA25641124718cd1ff15367499a173ae8e69d42a13874be4317b0357134da3756a03a
SHA5122965141a21e8fee470cce2b273f37d76795461dd52389aa9ee68e5bbc45dce6bb12ea58aeea7e0a27fe3e56e4100c0684ef516418fef25ff95e8d7221ebaec9a
-
Filesize
575B
MD5d574f4d1cfb51f091bda740e440c49af
SHA198a5a75cda4b889501cfe9055a09eb3f954f1342
SHA2567f2cfd4aad4fa200fb6b95bd6d33ef43878a751a140390bd3990bd2b79e7716f
SHA512e8669b9c4273da8f95e8137a103b7b64ee6136729278116e5b0aa79a2ec2e0211f477afc907251b49b8d1c764dc5b0183a41fa1754a6dce9a982be023d537119
-
Filesize
995B
MD5c93b547d6629e2c3d0d58fe051550534
SHA1b8e01a593dcdb56d63dd55b752f08cb25f240785
SHA256ed4d319f4b620af12695884656d760899969ad834baf513708bf2af2c8ec81ef
SHA512c37aa666f4e4138bd4a2bdc706b7012dbc22cce0fd40d59edb8ae28c0f65e30431c8b0c7751badeba275f6656fe04b0c2fe59ce06ac7e84fd087474adf8b644d
-
Filesize
765B
MD565efe47e8de2d36b4857585e4b7c0041
SHA1947bb7b7d7e42e625e45098b8b0558e27c9870c4
SHA2560cc1d76d97b7e484ab3021e9e01a5cb8215b4f805cb5ff25fa34d0db5c92f299
SHA5123f2b187b944f9ad893b1e1e7a0cee03207931630432112055c1990aa6440d58365545f31abf30a53fd261ebb735e367f697083e2f790df2543aadebddd49ff0e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
Filesize601B
MD5427297f7c94ad006d3c1c551ecbd7128
SHA16647d38bfa176a5545e7500756e65cea68ebc105
SHA25635fa4ecfa566e593d4aa9b978f8be4296c9847b1999020a582635e9925e2aef9
SHA512d1cc815628a1cd6cb819f6108e704a331330a9a5e643c4a2324477d484856b0e3549477eea5b257860bc1c8b221190c4b54d83c1858509ba29546193cd44e289
-
Filesize
601B
MD53654cffe1ab75371f327f6f5c4127a13
SHA1243fdc24c2b8d6e2eddf4882428fa1bdf7ac9d61
SHA2563eb471908818e41eb9269fd71409e6964c0dab6b63fccd1949d6d72c8334bad2
SHA51262d54a80ab8dadb6beff4e11fa1e673684dbd065bcca7a631e6170db44da1916779742bfeedf884323e1db72e809684747ac2f0f4a71d984586c023b549a38c1
-
Filesize
1KB
MD5be43286bea311f8e9de0906b32952569
SHA1e703fbd7eda000d8a4e5872f1ed61ef28fab9d98
SHA256a79d62745bbb39713bd3756d58ada2508e01d011bc4189be469a39e10c8e6fa0
SHA512f4cd7627591a7b74f9892f6d7d6640af0bfb1a1429e4aafa4fb96fff1e18ab1136f23af2a82cc86456a1114a95551ca4e815758253f584f69c952feac4eae568
-
Filesize
691B
MD5efa341631389f61a0df942dae0e5a012
SHA13c26174fe2767d4eba76f9c9dd8b87fd6c9ba640
SHA25642972d34eea4c135bb44f0247e482198346c67c2b05f5b952f3ebab1eb740592
SHA512c4d6418622152558aae079c9752c71a4100ef6b4e04d5bc553deb8a414ec3903cac1eed08f7dbce99bdecb5c404f3f6562280fadaff7b4c02d5ed43b164ad5da
-
Filesize
601B
MD52f33ac319a5a0d2fa850885e8990bf9a
SHA185c4ad4465f058b1ea60fd21b26fc80b5fd162dc
SHA256fefb267bcaa0418ef135a1594e13436055dd97d4743f9891401cb27437c69078
SHA512ab1183140675b4a04bc44bbd0852a31f63b24584a18c86c9a69b2e5fcfe2270a681d35b44cb98a991b87defffde630b0ce3a0849d122dcd8d93dd2df1693b8f5
-
Filesize
839B
MD5564f5370d238931ba1dca76e86c35b21
SHA16b4a5658756c76ff544683c879462e85cac46927
SHA256c6e144ffed6c8a3be87c6da96417dd4170bf82ba05973d81641fba0a35e17b39
SHA512f95d3808e5932ef461c338e1c35682ab268d4f47a60f582bf48a04c56165e5139efe23a399f297dcb62be82ab420ad4b691eea87a542a9f171861be36d967c73
-
Filesize
346KB
MD55e28186953cbf37fd7cd7cc9ae370723
SHA12810fc1f55d73a9e2a033913aae415d0887d323d
SHA25689a2b9f3b8ca126afc860ec3d9743265900d25b83c666441cddeb4db4ad06f4d
SHA5124dbb9fd8ae52636ba62ce0850f171210b103d52202c43e394afef06a710f579f26652ed86c578d18108a3448c3d9fd5760888ed96c84cda630e782ad40bdc7ef
-
Filesize
709B
MD5acfff5dc987cf91a450a42ece3692a14
SHA101a9d56b1e0c9365d29f740116c053571f3e17b6
SHA256623548d14807c69f8e377e79f408bf2e4b5fa853118de6875f8caf23f88fd7f1
SHA5129dbea243d2b7e10f10c95c2d528437a86e69d53474d6fdcb8f6239fa7d8771a38d48bfafb28fa535758fe6ee295f260c79a66a9e113cce84b70b63ac8d10cb4d
-
Filesize
829B
MD5ffaa8d132bfe6317f67c21766e440520
SHA1e0c06ed43ca5293d8dbcbcf8a63d5d3bc8201b75
SHA256d344e9bb70abaac00740603d9f0964a04a62c62f5ca41661fd3c83ed21734684
SHA5125ecd8f96b986c1af4e11eab05ee4206479e3cf324ed536df05a47d81a3a20db496c0e500272c95096ba13200cee14e91418c0a54fc82a387f11f4c99b6c218aa
-
Filesize
709B
MD5f5fa18367f7725df0e25e9b179d52ea3
SHA15b3cc53b9ad4acc32f671e80b1d929b194f85532
SHA256b45a7e6e56467892235250d2e4e22f52d5b52eeb2e1469a7cef027fbcfa2be51
SHA512a9173a45cd953003c0c8c794620619380d7c9b78cbccb5b7f0ce8f704d9d5fcaba086f504ae9b16b6d64a014236bcf032042dbee9617d7ceddc61ce6779542e1
-
Filesize
829B
MD555e017757846e5462b990ba5e926de1e
SHA1ea41d514b1e1d6f7cf72da0822d54ad7faa1b2f0
SHA256281ff46b36df951a8357e748187003a7c4ed327f9a962cea84142b3834545e52
SHA512b53a9095ed5fb5558c212b87aab9ab9b10ae640dde69950d444bee940a864230558530383b7aded85da1f5bbd5ee0e922a3350bae0417fb022c82a36f72e967c
-
Filesize
931B
MD517994f6c95f35e5a8e19540119ef82c1
SHA131316f30beac4dae9bed36480f912187b8dd4c6b
SHA2565c57f5b1ca87182db5ae3a9e37b3663de50fa5f64775fea8346fe297ae88108f
SHA512c260ae742b9c6867d1c6bae4cde65e940b30fae44baa4e3a8e47ff48a03cb57cd4666f9ef026e3dc39b4ab63deacbcd86a1e81b5e46e41a3f4b0c85e0ffd29aa
-
Filesize
931B
MD56d40f4a8f2f2ad59877cc61c5eafe81b
SHA154a7e52208acfe509569e290e088ee1f6b2d2746
SHA256f23f3baaea5fd0ab4393b58453a75a4ee97a3861a09cc9a7a72c5ce2c988309c
SHA51224bbb94118823836033ab6a9c1e9fc6a2154864d10342c386c44476a188c7b54ea41a5ef2acf94f8e459ddf4c81c8f0cbe0ab6c0a4fe6339b3df2557bd409dd5
-
Filesize
523B
MD530b8386a710c4114ce1b981249e028dc
SHA1109033811d3b0f46673093d040f40685046f0ade
SHA2568cab3ec6efc873a697a32cc5687cc4340508e6b8e948b91e5aa5b5f52d3fcd6a
SHA5123d5ede28c17634e41cdbdcc78efcafde1584f04e9b5441c794ea6ebf3ee1ef38c8aa110fdb1ee617ea15d9591694fe6fb206f3627a9e894df65244be80c8053e
-
Filesize
931B
MD536f32a7c249d2016be9864aeba986c04
SHA17c8203d9f75383ec8818f0c6ac51f022081b41c3
SHA2569c56cce618dc8ec656592a197472f43c6e1be971361777291c4ec623c3b135b0
SHA5126b18342fc96d22b6e040c46c58cf884066057132e925d714598b288aaa0ce816f8b9aa8563a67d1c7e23e16820c984164d78a82ab8a58e09eab1357af9713901
-
Filesize
709B
MD5c0e029f951797a3ca485c4c4d04408f1
SHA1accfd728caaad39c4271642225a1f0eff678ffa1
SHA25654dd52d1b9a740e12757dc17d38ed5d76423056884feafee70f37169f705ac4f
SHA512c0fe6429974e32ad00e0af66e5a609fb04cf8fbd41148b19f8fa9723febbdb4cccfbdede315e68ec8b56696db464e5aa49dacd1c81fb09638328c7f11b27eb57
-
Filesize
951B
MD5787ec341aac0f6551505625414eb08ed
SHA1187b09033450ff42d99acc3362c285f34146d379
SHA2567b0dbfb994c9fed34e0b5993257e08b1c87ebceb380e7b391b85172aff1a813c
SHA5124b05a7b8dd31a61f9d60e949f352332d1342900aaf135dbac15106397309e094979ef3668e5168d587e678d78586f7b66bceff1e5f70ab5041a087366232f6e2
-
Filesize
931B
MD50971686395851e755c41bb5580ed9c36
SHA13d847839779e8568ad8b0060d4a93d75e728b0ea
SHA25611ccbf1bc5ca24523eebe582541de75088b246c9a77c2ac76ea9c3901cdc195b
SHA512475ccc6aef4c837ab6140383d2228b5a07f7c200156778f020d9fa28605286ca907dfd7933e39df403478c4d38692cde4fa1aad8d91bc1129ed2aa3d7c3594fc
-
Filesize
601B
MD56b1a9e854d98c55a6be85b36a64ac2fd
SHA1fb0f8dac674cc2de15a23b032f4546662c0e699a
SHA2563b49f6578fafa672b1ed1b5e8b73a8b6b689905227b889996391c7f2179a332a
SHA512ff21c0e127ead6c4dd6e34d4903471da1bc8725d9c08c87a8410b98f500710f49f943e2f4903f6114839c97e548866a3c4fd91bfe5a1a884d24b2439f7832cba
-
Filesize
601B
MD571f6fe5ff98be9c2f11c5dce3db309a8
SHA1f9a84498a0ec0c0f8b25059cd026c49cd41f35c4
SHA256857a2bac54d55d0c56ea8a286975b54fe910da25d4a331a96fe4b4dea6d97daf
SHA512bf1c90741154ec38f890d040299b1bdff258c0577b815eda0e781e2731914c13838fc94d25d04d8e76daa3ebe7d754223f6b04333c1ca9bcd279518a7fcc04f3
-
Filesize
601B
MD588acb5e2d365357fa32c06944db49c93
SHA1777834743374913261db42b37d98f037f412f149
SHA256a1e298b5caa92085096a844ca015b9bf1739320125037a4a33bd730421886430
SHA51278dde3faeac4f8e2972e77d243caf07753cc91f33a6a9ac1d7691bdc8847404d4bf56151b9e046180cb007f82fa80f96998600b9ebd8a818bdcca8049da74ffb
-
Filesize
4KB
MD56b20d97132935396cb5fe7ae4f8c0770
SHA1d1a2678af6c97e9963fba1cc0ce666dd1909cfc7
SHA25607aee2ce377b7e8766f16ad301c445a50497d1bb847f306a4bffa70eb9aef261
SHA512cee78046f61e73437c27ad535ea11513d12383f61a2ec57eee8017b76b392598028c387ae96f5d064cfae3b7a7e612754067349c8baa5ecbaa06e72fe0ff3fc5
-
Filesize
142KB
MD55e2b550b801d03c20b759c5f6848a9f8
SHA1c006e2e9872f88c864a558beef2fd448125b2655
SHA256ac2a2c93fb01ef37afa9e75051ca222d37ecaf267867ae1907f293eb6faa2f3c
SHA512dc316b70f4676872edfe4a73f8871c62e129c6d846cfb97911edce35a6510adf9dacc0cac1ab24602a3a9b1edae764a6f993d4d12ca566271bdd4cf03d2984e4
-
Filesize
5KB
MD5f69e93e0802da41a17873230855d69c3
SHA1b77daac8c13072caae800087b46aaea632ed1840
SHA2560e6166e868e0ffb4a83701ff7c5994e4caa191b43b1e69da236a20fcfd629a8e
SHA512a08a5e4fc4571147b46ca472f492bfd8be017dccc8ffdd84c2b08f6544c09417361f4a1ed6dac1292f83583408a743fd83cd893f2483fbbe07aa192e3f746aa7
-
Filesize
20B
MD50083cd302a99089f6c0bafb3155907a0
SHA133ea974369a5cc1a3d124a007d1a3170b76285d1
SHA2569649b32d5a49aebbb2c72d501afce0566e60d7727b1bdf94f56b4d2c85fad6d1
SHA5128dbac58292f2275a19e77b4e76324f628683ded2d3a7b98addd6158356d5bf561ef71e2067c9e9a0187efac0becfcdf7535d04d574ebf6c1c35791a493a52ab0
-
Filesize
312B
MD5d013f52f7ca166dcc496cd2b17e6cbde
SHA11367af8b36605be7e74dc4d467b74b45b79495a4
SHA2566b77af0f50c2c6c0cc728b29d86003e0eaa527e9f8653daa1bf73d12b8d1a382
SHA512422cda93448cb3501129b0002589b08991f010f425798bd5ea39964109cf47361b64ac382206af2d3f69a5ec401909831766064cbf455f5dd8b9e1ac367ef213
-
Filesize
50B
MD5837f9483a4d9fb834d75537beb1c9488
SHA17421df5e92fbd2ef04eac5ede4397e4b87a3b7c2
SHA256ec64e2a730d0e32ff61a98f34ffdda69ea172234f8f432b95766e38c0f898e2d
SHA51237aa585177f560cd8d7b60303e820a7fa08f1a73d5fb79a6bae1f2c14e11d0f2d573059eb4e5c4bccb5021b336531d1eb3076a357b75a02c56570585a271cc69