Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
Resource
win10v2004-20240802-en
General
-
Target
scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe
-
Size
159KB
-
MD5
80f4a1d42e2d4205cedf96909091cf84
-
SHA1
b9500d8a20ea3831f0843ca8636be11fef836625
-
SHA256
9d41b2f7c07110fb855c62b5e7e330a597860916599e73dd3505694fd1bbe163
-
SHA512
42168abc5f69ea35756fa71e1fd49c47b20b4111fc13e4593ae55f576e7f3d9d6583213547cbb01c245e7616b542ee160caa96022ca561eaf290db8818035fd3
-
SSDEEP
3072:/V2UzNeZWtTsi2OHAXDCtY6cgtz45qS7IfJJoSl:NHReZETV2UAXDzb2icl
Malware Config
Extracted
C:\Program Files\7-Zip\!!readme!!!.txt
underground
http://ehehqyhw3iev2vfso4vqs7kcrzltfebe5vbimq62p2ja7pslczs3q6qd.onion/
Signatures
-
Underground Team
Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.
-
Clears Windows event logs 1 TTPs 64 IoCs
pid Process 4808 wevtutil.exe 3856 wevtutil.exe 2908 wevtutil.exe 3556 wevtutil.exe 3760 wevtutil.exe 4088 wevtutil.exe 1752 wevtutil.exe 3172 wevtutil.exe 3476 wevtutil.exe 3356 wevtutil.exe 3488 wevtutil.exe 4612 wevtutil.exe 3784 wevtutil.exe 2696 wevtutil.exe 4048 wevtutil.exe 216 wevtutil.exe 4136 wevtutil.exe 4964 wevtutil.exe 5088 wevtutil.exe 4024 wevtutil.exe 3808 wevtutil.exe 4300 wevtutil.exe 4700 wevtutil.exe 2084 wevtutil.exe 3284 wevtutil.exe 568 wevtutil.exe 1468 wevtutil.exe 2460 wevtutil.exe 3772 wevtutil.exe 352 wevtutil.exe 2428 wevtutil.exe 3448 wevtutil.exe 1804 wevtutil.exe 3664 wevtutil.exe 3796 wevtutil.exe 5016 wevtutil.exe 216 wevtutil.exe 692 wevtutil.exe 3268 wevtutil.exe 4940 wevtutil.exe 3652 wevtutil.exe 4772 wevtutil.exe 2652 wevtutil.exe 3496 wevtutil.exe 3676 wevtutil.exe 2864 wevtutil.exe 4964 wevtutil.exe 208 wevtutil.exe 2932 wevtutil.exe 4576 wevtutil.exe 3924 wevtutil.exe 4036 wevtutil.exe 1844 wevtutil.exe 1464 wevtutil.exe 2524 wevtutil.exe 3052 wevtutil.exe 4088 wevtutil.exe 4060 wevtutil.exe 4880 wevtutil.exe 4844 wevtutil.exe 1772 wevtutil.exe 1236 wevtutil.exe 3604 wevtutil.exe 2820 wevtutil.exe -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Deletes itself 1 IoCs
pid Process 3216 cmd.exe -
Drops desktop.ini file(s) 40 IoCs
description ioc Process File opened for modification \??\c:\program files\microsoft games\mahjong\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\favorites\links\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\links\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\music\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\recorded tv\sample media\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\purble place\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\downloads\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\contacts\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\pictures\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\music\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\recorded tv\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\1033\dataservices\DESKTOP.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\favorites\links for united states\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\searches\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\videos\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\desktop\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\documents\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\downloads\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\hearts\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\common files\microsoft shared\stationery\Desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\libraries\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\music\sample music\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\pictures\sample pictures\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\solitaire\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\documents\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\$recycle.bin\s-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\freecell\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\chess\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\spidersolitaire\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\desktop\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\favorites\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\admin\saved games\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\pictures\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\f:\$recycle.bin\s-1-5-21-3290804112-2823094203-3137964600-1000\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\common files\microsoft shared\stationery\Desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\videos\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\users\public\videos\sample videos\desktop.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe -
Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 3148 wevtutil.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\lib\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\chess\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\multiplayer\backgammon\de-de\bckgzm.exe.mui scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows defender\es-es\MpAsDesc.dll.mui scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows mail\fr-fr\msoeres.dll.mui scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\calendar.gadget\images\rings-desk.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\clock.gadget\images\settings_corner_top_right.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\slideshow.gadget\it-it\slideShow.html scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\J0291794.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\1033\pubspapr\PDIR49F.gif scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\forms\1033\SCDCNCLL.ico scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\pubwiz\GIFT98.poc scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\de-de\gadget.xml scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\weather.gadget\images\undocked_black_snow.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\1033\dataservices\DESKTOP.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\dvd maker\shared\dvdstyles\push\NavigationUp_SelectionSubpicture.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File created \??\c:\program files (x86)\common files\microsoft shared\office14\office setup controller\onenote.en-us\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\BD00160_.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\media\office14\bullets\BD14983_.gif scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\forms\1033\TASK.cfg scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\windows sidebar\gadgets\calendar.gadget\drag.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\de-de\TipBand.dll.mui scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\es-es\mshwLatin.dll.mui scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\ja-jp\rtscom.dll.mui scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\FD02068_.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\windows sidebar\gadgets\slideshow.gadget\images\prev_rest.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\7-zip\lang\ro.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\dvd maker\shared\dvdstyles\Heart_ButtonGraphic.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\clock.gadget\images\square_s.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\SO02024_.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\videolan\vlc\locale\tr\lc_messages\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File created \??\c:\program files (x86)\microsoft office\office14\1033\grooveforms5\formsstyles\swirl\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\weather.gadget\images\16.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\adobe\reader 9.0\resource\typesupport\unicode\mappings\adobe\symbol.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\J0304371.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\windows sidebar\settings.ini scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\videolan\vlc\locale\bs\lc_messages\vlc.mo scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\FormsHomePage.html scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms4\rtf_alignleft.gif scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\minesweeper\en-us\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File created \??\c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\grooveforms\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File created \??\c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\welcome tool\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\7-zip\History.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\windows sidebar\gadgets\weather.gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\J0099193.gif scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\document themes 14\Technic.thmx scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\NA00330_.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\PH02748G.gif scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\microsoft games\freecell\!!readme!!!.txt scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\videolan\vlc\locale\sv\lc_messages\vlc.mo scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\lib\zi\ZoneInfoMappings scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\clipart\pub60cor\J0187647.wmf scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\OMML2MML.xsl scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\pubwiz\NEWS.xml scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe File opened for modification \??\c:\program files (x86)\microsoft office\office14\pubwiz\ORIG98.poc scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 668 vssadmin.exe 2408 vssadmin.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 1944 reg.exe 2644 reg.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2824 vssvc.exe Token: SeRestorePrivilege 2824 vssvc.exe Token: SeAuditPrivilege 2824 vssvc.exe Token: SeSecurityPrivilege 3244 wevtutil.exe Token: SeBackupPrivilege 3244 wevtutil.exe Token: SeSecurityPrivilege 3256 wevtutil.exe Token: SeBackupPrivilege 3256 wevtutil.exe Token: SeSecurityPrivilege 3272 wevtutil.exe Token: SeBackupPrivilege 3272 wevtutil.exe Token: SeSecurityPrivilege 3284 wevtutil.exe Token: SeBackupPrivilege 3284 wevtutil.exe Token: SeSecurityPrivilege 3296 wevtutil.exe Token: SeBackupPrivilege 3296 wevtutil.exe Token: SeSecurityPrivilege 3308 wevtutil.exe Token: SeBackupPrivilege 3308 wevtutil.exe Token: SeSecurityPrivilege 3320 wevtutil.exe Token: SeBackupPrivilege 3320 wevtutil.exe Token: SeSecurityPrivilege 3332 wevtutil.exe Token: SeBackupPrivilege 3332 wevtutil.exe Token: SeSecurityPrivilege 3344 wevtutil.exe Token: SeBackupPrivilege 3344 wevtutil.exe Token: SeSecurityPrivilege 3356 wevtutil.exe Token: SeBackupPrivilege 3356 wevtutil.exe Token: SeSecurityPrivilege 3368 wevtutil.exe Token: SeBackupPrivilege 3368 wevtutil.exe Token: SeSecurityPrivilege 3380 wevtutil.exe Token: SeBackupPrivilege 3380 wevtutil.exe Token: SeSecurityPrivilege 3392 wevtutil.exe Token: SeBackupPrivilege 3392 wevtutil.exe Token: SeSecurityPrivilege 3404 wevtutil.exe Token: SeBackupPrivilege 3404 wevtutil.exe Token: SeSecurityPrivilege 3420 wevtutil.exe Token: SeBackupPrivilege 3420 wevtutil.exe Token: SeSecurityPrivilege 3428 wevtutil.exe Token: SeBackupPrivilege 3428 wevtutil.exe Token: SeSecurityPrivilege 3456 wevtutil.exe Token: SeBackupPrivilege 3456 wevtutil.exe Token: SeSecurityPrivilege 3440 wevtutil.exe Token: SeBackupPrivilege 3440 wevtutil.exe Token: SeSecurityPrivilege 3472 wevtutil.exe Token: SeBackupPrivilege 3472 wevtutil.exe Token: SeSecurityPrivilege 3460 wevtutil.exe Token: SeBackupPrivilege 3460 wevtutil.exe Token: SeSecurityPrivilege 3488 wevtutil.exe Token: SeBackupPrivilege 3488 wevtutil.exe Token: SeSecurityPrivilege 4108 wevtutil.exe Token: SeBackupPrivilege 4108 wevtutil.exe Token: SeSecurityPrivilege 4124 wevtutil.exe Token: SeBackupPrivilege 4124 wevtutil.exe Token: SeSecurityPrivilege 4136 wevtutil.exe Token: SeBackupPrivilege 4136 wevtutil.exe Token: SeSecurityPrivilege 4148 wevtutil.exe Token: SeBackupPrivilege 4148 wevtutil.exe Token: SeSecurityPrivilege 4160 wevtutil.exe Token: SeBackupPrivilege 4160 wevtutil.exe Token: SeSecurityPrivilege 4172 wevtutil.exe Token: SeBackupPrivilege 4172 wevtutil.exe Token: SeSecurityPrivilege 4184 wevtutil.exe Token: SeBackupPrivilege 4184 wevtutil.exe Token: SeSecurityPrivilege 4196 wevtutil.exe Token: SeBackupPrivilege 4196 wevtutil.exe Token: SeSecurityPrivilege 4212 wevtutil.exe Token: SeBackupPrivilege 4212 wevtutil.exe Token: SeSecurityPrivilege 4220 wevtutil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2408 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 30 PID 2636 wrote to memory of 2408 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 30 PID 2636 wrote to memory of 2408 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 30 PID 2636 wrote to memory of 1944 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 31 PID 2636 wrote to memory of 1944 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 31 PID 2636 wrote to memory of 1944 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 31 PID 2636 wrote to memory of 2772 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 34 PID 2636 wrote to memory of 2772 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 34 PID 2636 wrote to memory of 2772 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 34 PID 2772 wrote to memory of 2668 2772 net.exe 36 PID 2772 wrote to memory of 2668 2772 net.exe 36 PID 2772 wrote to memory of 2668 2772 net.exe 36 PID 2636 wrote to memory of 668 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 40 PID 2636 wrote to memory of 668 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 40 PID 2636 wrote to memory of 668 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 40 PID 2636 wrote to memory of 2644 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 42 PID 2636 wrote to memory of 2644 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 42 PID 2636 wrote to memory of 2644 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 42 PID 2636 wrote to memory of 332 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 43 PID 2636 wrote to memory of 332 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 43 PID 2636 wrote to memory of 332 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 43 PID 332 wrote to memory of 1120 332 net.exe 46 PID 332 wrote to memory of 1120 332 net.exe 46 PID 332 wrote to memory of 1120 332 net.exe 46 PID 2636 wrote to memory of 3216 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 49 PID 2636 wrote to memory of 3216 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 49 PID 2636 wrote to memory of 3216 2636 scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe 49 PID 3216 wrote to memory of 3236 3216 cmd.exe 51 PID 3216 wrote to memory of 3236 3216 cmd.exe 51 PID 3216 wrote to memory of 3236 3216 cmd.exe 51 PID 3236 wrote to memory of 3244 3236 cmd.exe 52 PID 3236 wrote to memory of 3244 3236 cmd.exe 52 PID 3236 wrote to memory of 3244 3236 cmd.exe 52 PID 3216 wrote to memory of 3256 3216 cmd.exe 53 PID 3216 wrote to memory of 3256 3216 cmd.exe 53 PID 3216 wrote to memory of 3256 3216 cmd.exe 53 PID 3216 wrote to memory of 3272 3216 cmd.exe 54 PID 3216 wrote to memory of 3272 3216 cmd.exe 54 PID 3216 wrote to memory of 3272 3216 cmd.exe 54 PID 3216 wrote to memory of 3284 3216 cmd.exe 55 PID 3216 wrote to memory of 3284 3216 cmd.exe 55 PID 3216 wrote to memory of 3284 3216 cmd.exe 55 PID 3216 wrote to memory of 3296 3216 cmd.exe 56 PID 3216 wrote to memory of 3296 3216 cmd.exe 56 PID 3216 wrote to memory of 3296 3216 cmd.exe 56 PID 3216 wrote to memory of 3308 3216 cmd.exe 57 PID 3216 wrote to memory of 3308 3216 cmd.exe 57 PID 3216 wrote to memory of 3308 3216 cmd.exe 57 PID 3216 wrote to memory of 3320 3216 cmd.exe 58 PID 3216 wrote to memory of 3320 3216 cmd.exe 58 PID 3216 wrote to memory of 3320 3216 cmd.exe 58 PID 3216 wrote to memory of 3332 3216 cmd.exe 59 PID 3216 wrote to memory of 3332 3216 cmd.exe 59 PID 3216 wrote to memory of 3332 3216 cmd.exe 59 PID 3216 wrote to memory of 3344 3216 cmd.exe 60 PID 3216 wrote to memory of 3344 3216 cmd.exe 60 PID 3216 wrote to memory of 3344 3216 cmd.exe 60 PID 3216 wrote to memory of 3356 3216 cmd.exe 61 PID 3216 wrote to memory of 3356 3216 cmd.exe 61 PID 3216 wrote to memory of 3356 3216 cmd.exe 61 PID 3216 wrote to memory of 3368 3216 cmd.exe 62 PID 3216 wrote to memory of 3368 3216 cmd.exe 62 PID 3216 wrote to memory of 3368 3216 cmd.exe 62 PID 3216 wrote to memory of 3380 3216 cmd.exe 63 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe"C:\Users\Admin\AppData\Local\Temp\scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2408
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f2⤵
- Modifies registry key
PID:1944
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop MSSQLSERVER /f /m2⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /f /m3⤵PID:2668
-
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:668
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f2⤵
- Modifies registry key
PID:2644
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop MSSQLSERVER /f /m2⤵
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLSERVER /f /m3⤵PID:1120
-
-
-
C:\Windows\system32\cmd.execmd /c temp.cmd C:\Users\Admin\AppData\Local\Temp\scenario_472897___e7418389-a33e-42a7-8a6f-0c5d03e00962.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil.exe el3⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\system32\wevtutil.exewevtutil.exe el4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Application"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DebugChannel"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3284
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DirectShowFilterGraph"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DirectShowPluginControl"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Els_Hyphenation/Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "EndpointMapper"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3332
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "ForwardedEvents"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "HardwareEvents"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Internet Explorer"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Key Management Service"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MF_MediaFoundationDeviceProxy"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Media Center"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationDeviceProxy"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPerformance"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPipeline"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPlatform"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IE/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3472
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IEDVTOOL/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3460
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"3⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ADSI/Debug"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4148
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-API-Tracing/Operational"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/General"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4172
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4184
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AltTab/Diagnostic"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4212
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppID/Operational"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"3⤵PID:4232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"3⤵PID:4244
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"3⤵PID:4256
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"3⤵PID:4268
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"3⤵PID:4280
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"3⤵PID:4292
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"3⤵PID:4304
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"3⤵PID:4316
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"3⤵PID:4328
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"3⤵PID:4340
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"3⤵PID:4352
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"3⤵PID:4364
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"3⤵PID:4376
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Operational"3⤵PID:4388
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Performance"3⤵PID:4400
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audit/Analytic"3⤵PID:4416
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"3⤵PID:1252
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"3⤵PID:4424
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Backup"3⤵PID:4436
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"3⤵PID:4448
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"3⤵PID:4460
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"3⤵PID:4472
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"3⤵PID:2324
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"3⤵PID:4484
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"3⤵PID:4496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"3⤵PID:2628
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"3⤵PID:2932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"3⤵PID:4504
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"3⤵PID:4516
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"3⤵PID:4528
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"3⤵PID:4544
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CDROM/Operational"3⤵PID:4548
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/Analytic"3⤵PID:4564
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"3⤵PID:4576
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Calculator/Debug"3⤵PID:4588
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"3⤵PID:4600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"3⤵
- Clears Windows event logs
PID:4612
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"3⤵PID:4624
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"3⤵PID:4636
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"3⤵PID:4648
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"3⤵PID:4660
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"3⤵PID:4676
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"3⤵PID:4688
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"3⤵PID:4700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"3⤵PID:4712
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"3⤵PID:4724
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"3⤵PID:4736
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"3⤵PID:4748
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"3⤵PID:4760
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"3⤵
- Clears Windows event logs
PID:4772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"3⤵PID:4784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"3⤵PID:4796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"3⤵PID:4808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"3⤵PID:4820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"3⤵PID:4832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Logging"3⤵
- Clears Windows event logs
PID:4844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXP/Analytic"3⤵PID:4856
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"3⤵PID:4868
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"3⤵PID:4880
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"3⤵PID:4892
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"3⤵PID:4904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"3⤵PID:4916
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"3⤵PID:4928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"3⤵PID:4940
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"3⤵PID:4952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"3⤵
- Clears Windows event logs
PID:4964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"3⤵PID:4976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DhcpNap/Admin"3⤵PID:4988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DhcpNap/Operational"3⤵PID:5000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"3⤵PID:5012
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"3⤵
- Clears Windows event logs
PID:5016
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"3⤵PID:5036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"3⤵PID:5048
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"3⤵PID:5060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"3⤵PID:5076
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"3⤵
- Clears Windows event logs
PID:5088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"3⤵PID:5100
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"3⤵PID:5112
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"3⤵
- Clears Windows event logs
PID:3496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"3⤵PID:3508
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"3⤵PID:3520
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"3⤵PID:3532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"3⤵PID:3548
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"3⤵
- Clears Windows event logs
PID:3556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"3⤵PID:3568
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"3⤵PID:3580
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"3⤵PID:3592
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"3⤵
- Clears Windows event logs
PID:3604
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"3⤵PID:3616
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"3⤵PID:3628
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"3⤵PID:3640
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"3⤵
- Clears Windows event logs
PID:3652
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"3⤵PID:3664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"3⤵
- Clears Windows event logs
PID:3676
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"3⤵PID:3688
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"3⤵PID:3700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"3⤵PID:3712
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"3⤵PID:3728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"3⤵PID:3708
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"3⤵PID:3748
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"3⤵
- Clears Windows event logs
PID:3760
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"3⤵PID:3772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"3⤵
- Clears Windows event logs
PID:3784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"3⤵PID:3796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"3⤵PID:3808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"3⤵PID:3820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"3⤵PID:3832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectWrite/Tracing"3⤵PID:3844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Disk/Operational"3⤵PID:3856
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"3⤵PID:3872
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"3⤵PID:3880
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"3⤵PID:3892
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"3⤵PID:3904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"3⤵PID:3916
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"3⤵PID:3936
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Documents/Performance"3⤵PID:3924
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"3⤵PID:3952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"3⤵PID:3964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"3⤵PID:3980
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskRingtone/Analytic"3⤵PID:3988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"3⤵PID:4000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EFS/Debug"3⤵PID:4012
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"3⤵
- Clears Windows event logs
PID:4024
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Debug"3⤵
- Clears Windows event logs
PID:4036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Operational"3⤵PID:4048
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"3⤵
- Clears Windows event logs
PID:4060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"3⤵PID:4072
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"3⤵PID:4080
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"3⤵PID:2084
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"3⤵
- Clears Windows event logs
PID:4088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Debug"3⤵PID:2752
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Analytic"3⤵PID:2556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Debug"3⤵PID:2664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Operational"3⤵PID:2608
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"3⤵PID:2000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"3⤵PID:208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"3⤵
- Clears Windows event logs
PID:216
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"3⤵PID:2388
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"3⤵PID:232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"3⤵
- Clears Windows event logs
PID:2820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"3⤵
- Clears Windows event logs
PID:2696
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"3⤵PID:2760
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GettingStarted/Diagnostic"3⤵PID:2648
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"3⤵PID:2804
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HAL/Debug"3⤵PID:1136
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"3⤵PID:776
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"3⤵
- Clears Windows event logs
PID:568
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"3⤵PID:1232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Help/Operational"3⤵PID:2992
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"3⤵PID:1468
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"3⤵PID:3020
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"3⤵PID:3060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"3⤵PID:2152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"3⤵PID:2096
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"3⤵PID:2128
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HotStart/Diagnostic"3⤵
- Clears Windows event logs
PID:2428
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HttpService/Trace"3⤵PID:1904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKE/Operational"3⤵PID:1976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"3⤵PID:2896
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPBusEnum/Tracing"3⤵PID:1432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"3⤵PID:1804
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"3⤵PID:1276
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International/Operational"3⤵PID:2784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"3⤵PID:2908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"3⤵PID:2888
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"3⤵PID:2808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"3⤵PID:2376
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"3⤵
- Clears Windows event logs
PID:2864
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"3⤵PID:2632
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"3⤵PID:1940
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"3⤵
- Clears Windows event logs
PID:1844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"3⤵PID:1736
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"3⤵PID:1780
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"3⤵PID:1556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"3⤵PID:976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Diagnostic"3⤵PID:352
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"3⤵PID:3024
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"3⤵PID:556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"3⤵PID:348
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"3⤵PID:2960
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"3⤵PID:848
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"3⤵PID:2108
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"3⤵
- Clears Windows event logs
PID:1772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"3⤵PID:3004
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"3⤵PID:2292
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"3⤵PID:1800
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"3⤵PID:2332
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"3⤵PID:2364
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"3⤵PID:2316
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"3⤵
- Clears Windows event logs
PID:2460
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Known Folders API Service"3⤵PID:2188
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"3⤵PID:2312
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"3⤵PID:2504
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"3⤵PID:2512
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"3⤵PID:2248
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"3⤵PID:2020
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"3⤵PID:2144
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MCT/Operational"3⤵PID:2244
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"3⤵
- Clears Windows event logs
PID:1464
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"3⤵PID:2060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"3⤵
- Clears Windows event logs
PID:2524
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"3⤵PID:1084
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"3⤵PID:2168
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"3⤵PID:1840
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Admin"3⤵PID:1120
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Analytic"3⤵PID:632
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Debug"3⤵PID:2404
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Operational"3⤵PID:1600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"3⤵PID:2540
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"3⤵PID:2544
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"3⤵
- Clears Windows event logs
PID:1752
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"3⤵PID:2600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"3⤵PID:2672
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"3⤵
- Clears Windows event logs
PID:2652
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"3⤵PID:1768
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Operational"3⤵PID:2488
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"3⤵PID:1532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"3⤵PID:1520
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"3⤵PID:1332
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Operational"3⤵PID:2176
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NTLM/Operational"3⤵PID:2216
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"3⤵
- Clears Windows event logs
PID:1236
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"3⤵
- Clears Windows event logs
PID:692
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetShell/Performance"3⤵PID:1980
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"3⤵PID:1564
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/Operational"3⤵PID:1696
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/WHC"3⤵PID:1956
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"3⤵PID:2256
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"3⤵PID:1240
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"3⤵PID:1472
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"3⤵PID:2984
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"3⤵PID:2336
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"3⤵PID:2068
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"3⤵PID:2064
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"3⤵PID:1460
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine/Diagnostic"3⤵PID:1948
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"3⤵PID:2996
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"3⤵PID:880
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"3⤵PID:2284
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"3⤵PID:2948
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"3⤵PID:1584
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"3⤵PID:2776
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"3⤵PID:3096
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"3⤵PID:3108
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"3⤵PID:3120
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeopleNearMe/Operational"3⤵PID:2676
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"3⤵PID:3132
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"3⤵PID:3168
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"3⤵
- Power Settings
PID:3148
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"3⤵
- Clears Windows event logs
PID:3172
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"3⤵PID:3180
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"3⤵PID:3200
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"3⤵PID:2112
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"3⤵
- Clears Windows event logs
PID:3052
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Admin"3⤵PID:2636
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Debug"3⤵PID:3232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Operational"3⤵PID:3244
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"3⤵
- Clears Windows event logs
PID:3268
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"3⤵PID:3280
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"3⤵PID:3292
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"3⤵PID:3304
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/Debug"3⤵PID:3312
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"3⤵PID:3328
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"3⤵PID:3336
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"3⤵PID:3352
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"3⤵PID:3360
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"3⤵PID:3376
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Recovery/Operational"3⤵PID:3384
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"3⤵PID:3400
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"3⤵PID:3408
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"3⤵PID:3432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"3⤵PID:3436
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"3⤵
- Clears Windows event logs
PID:3476
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"3⤵
- Clears Windows event logs
PID:3448
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"3⤵PID:3464
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"3⤵PID:4104
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"3⤵PID:4112
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"3⤵PID:4116
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"3⤵PID:4132
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"3⤵PID:4140
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"3⤵PID:4156
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"3⤵PID:4168
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"3⤵PID:4180
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"3⤵PID:4188
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"3⤵PID:4208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"3⤵PID:4200
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"3⤵PID:4228
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sens/Debug"3⤵PID:4240
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"3⤵PID:4252
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"3⤵PID:4264
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"3⤵PID:4276
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Setup/Analytic"3⤵PID:4288
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"3⤵
- Clears Windows event logs
PID:4300
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"3⤵PID:4312
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"3⤵PID:4324
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"3⤵PID:4336
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"3⤵PID:4348
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"3⤵PID:4360
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"3⤵PID:4372
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"3⤵PID:4384
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"3⤵PID:4396
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"3⤵PID:4408
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"3⤵PID:4420
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"3⤵PID:1044
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"3⤵PID:4432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"3⤵PID:4444
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"3⤵PID:4456
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sidebar/Diagnostic"3⤵PID:4468
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"3⤵PID:1664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"3⤵PID:4476
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"3⤵PID:4492
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Admin"3⤵PID:2280
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Debug"3⤵PID:2472
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Diagnostic"3⤵PID:2628
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"3⤵
- Clears Windows event logs
PID:2932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StorPort/Operational"3⤵PID:4504
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"3⤵PID:4516
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"3⤵PID:4528
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Superfetch/Main"3⤵PID:4544
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"3⤵PID:4548
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"3⤵PID:4564
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"3⤵
- Clears Windows event logs
PID:4576
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"3⤵PID:4588
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"3⤵PID:4600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"3⤵PID:4612
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"3⤵PID:4624
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"3⤵PID:4636
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"3⤵PID:4648
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"3⤵PID:4660
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"3⤵PID:4676
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"3⤵PID:4688
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"3⤵
- Clears Windows event logs
PID:4700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"3⤵PID:4712
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"3⤵PID:4724
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"3⤵PID:4736
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"3⤵PID:4748
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"3⤵PID:4760
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"3⤵PID:4772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"3⤵PID:4784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"3⤵PID:4796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"3⤵
- Clears Windows event logs
PID:4808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"3⤵PID:4820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"3⤵PID:4832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"3⤵PID:4844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"3⤵PID:4856
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"3⤵PID:4868
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"3⤵
- Clears Windows event logs
PID:4880
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"3⤵PID:4892
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"3⤵PID:4904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"3⤵PID:4916
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"3⤵PID:4928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"3⤵
- Clears Windows event logs
PID:4940
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"3⤵PID:4952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"3⤵
- Clears Windows event logs
PID:4964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"3⤵PID:4976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"3⤵PID:4988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"3⤵PID:5000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"3⤵PID:5012
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"3⤵PID:5016
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"3⤵PID:5036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TunnelDriver"3⤵PID:5048
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"3⤵PID:5060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UAC/Operational"3⤵PID:5076
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"3⤵PID:5088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"3⤵PID:5100
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"3⤵PID:5112
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"3⤵PID:3496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"3⤵PID:3508
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"3⤵PID:3520
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"3⤵PID:3532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"3⤵PID:3548
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"3⤵PID:3556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"3⤵PID:3568
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"3⤵PID:3580
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"3⤵PID:3592
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"3⤵PID:3604
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceNotifications"3⤵PID:3616
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"3⤵PID:3628
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"3⤵PID:3640
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"3⤵PID:3652
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VAN/Diagnostic"3⤵
- Clears Windows event logs
PID:3664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"3⤵PID:3676
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VHDMP/Operational"3⤵PID:3688
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"3⤵PID:3700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"3⤵PID:3712
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"3⤵PID:3728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"3⤵PID:3708
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"3⤵PID:3748
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WER-Diag/Operational"3⤵PID:3760
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WFP/Analytic"3⤵
- Clears Windows event logs
PID:3772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WFP/Operational"3⤵PID:3784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WLAN-AutoConfig/Operational"3⤵
- Clears Windows event logs
PID:3796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"3⤵
- Clears Windows event logs
PID:3808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"3⤵PID:3820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMI-Activity/Trace"3⤵PID:3832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPDMCCore/Diagnostic"3⤵PID:3844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPDMCUI/Diagnostic"3⤵
- Clears Windows event logs
PID:3856
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"3⤵PID:3872
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"3⤵PID:3880
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPNSSUI/Diagnostic"3⤵PID:3892
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"3⤵PID:3904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Operational"3⤵PID:3916
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"3⤵PID:3936
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"3⤵
- Clears Windows event logs
PID:3924
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"3⤵PID:3952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WSC-SRV/Diagnostic"3⤵PID:3964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WUSA/Debug"3⤵PID:3980
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-MM-Events/Diagnostic"3⤵PID:3988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic"3⤵PID:4000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-SVC-Events/Diagnostic"3⤵PID:4012
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-UI-Events/Diagnostic"3⤵PID:4024
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WebIO-NDF/Diagnostic"3⤵PID:4036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WebIO/Diagnostic"3⤵
- Clears Windows event logs
PID:4048
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WebServices/Tracing"3⤵PID:4060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Concurrency"3⤵PID:4072
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Power"3⤵PID:4080
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Render"3⤵
- Clears Windows event logs
PID:2084
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Tracing"3⤵
- Clears Windows event logs
PID:4088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/UIPI"3⤵PID:2752
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinHTTP-NDF/Diagnostic"3⤵PID:2556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinHttp/Diagnostic"3⤵PID:2664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinINet/Analytic"3⤵PID:2608
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinRM/Analytic"3⤵PID:2000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinRM/Debug"3⤵
- Clears Windows event logs
PID:208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinRM/Operational"3⤵
- Clears Windows event logs
PID:216
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windeploy/Analytic"3⤵PID:2388
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"3⤵PID:232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Defender/WHC"3⤵PID:2820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity"3⤵PID:2696
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose"3⤵PID:2760
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"3⤵PID:2648
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose"3⤵PID:2804
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsBackup/ActionCenter"3⤵PID:1136
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Debug"3⤵PID:776
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Operational"3⤵PID:568
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Operational"3⤵PID:1232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Tracing"3⤵PID:2992
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsUpdateClient/Operational"3⤵
- Clears Windows event logs
PID:1468
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wininit/Diagnostic"3⤵PID:3020
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winlogon/Diagnostic"3⤵PID:3060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winlogon/Operational"3⤵PID:2152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winsock-AFD/Operational"3⤵PID:2096
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winsock-WS2HELP/Operational"3⤵PID:2128
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winsrv/Analytic"3⤵PID:2428
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Diagnostic"3⤵PID:1904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Operational"3⤵PID:1976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wordpad/Admin"3⤵PID:2896
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wordpad/Debug"3⤵PID:1432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wordpad/Diagnostic"3⤵
- Clears Windows event logs
PID:1804
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-mobsync/Diagnostic"3⤵PID:1276
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ntshrui"3⤵PID:2784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-osk/Diagnostic"3⤵
- Clears Windows event logs
PID:2908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-stobject/Diagnostic"3⤵PID:2888
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "OAlerts"3⤵PID:2808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Security"3⤵PID:2376
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Setup"3⤵PID:2864
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "System"3⤵PID:2632
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "TabletPC_InputPanel_Channel"3⤵PID:1940
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WINDOWS_MP4SDECD_CHANNEL"3⤵PID:1844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WINDOWS_MSMPEG2VDEC_CHANNEL"3⤵PID:1736
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WINDOWS_WMPHOTO_CHANNEL"3⤵PID:1780
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WMPSetup"3⤵PID:1556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WMPSyncEngine"3⤵PID:976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Windows PowerShell"3⤵
- Clears Windows event logs
PID:352
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin"3⤵PID:3024
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "muxencode"3⤵PID:556
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5e3adffe7c5c5a0512861866a9fac99d0
SHA14e1bd7b5ac85d977354ef69aefa30b333e767a17
SHA25664baeebbf072ee1995a696b055beb290ec8adcf85a5104b3fe9c87d1ae5e2bd0
SHA5125653fb12d3d90d633be01720059339fa447c0e186d279db83e39025fd8b6bf0da8529a638c27151c0b3ca2ef3cd4f9c9efa85416fe35ec0c678facb2e4e0d5e6
-
Filesize
134B
MD5d81eac651a27977bd85805ff21a4bb7e
SHA178941577c618fd03df79d9e0921bb9a5e5063892
SHA256442c16903c74297f029c964e9c78302816d3e9b9a1562ea8fd3d652790db3a5e
SHA512b50bc5044cd6fa3a02fa2a34c63a6ed1da4c43df6a496fc92b99c9cd896b5d04dc2af57a66f248a328c0027f767af9f36048a640c027744c47389a6cbba1c88d