Analysis
-
max time kernel
111s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-10-2024 21:03
General
-
Target
RNSM00446.7z
-
Size
68.4MB
-
MD5
3f1f1933521d96cb2a537eb57f0b8f4b
-
SHA1
24b372467e9a2ad7aeac32ddac4aa71f22f3833c
-
SHA256
b964e2c619289523043166d503c2f16b7b350f49533bc72d986adf09377bced0
-
SHA512
251905f5fc6d738a8465ddda9d82cc357f9d2197fa9a7023447145b19587d1b8be56cfc7f0481f879a74bd9a4cd1777c929c90b76740de88bf4a083ca0ff0e82
-
SSDEEP
1572864:WK6vBCJ4ynaQtuzbKsm5v5P04ljYEKR7sttLlxmi3bzvBZVdr:WK6vkfaBm5cCYTsHLlJf/
Score
10/10
Malware Config
Extracted
Family
nullmixer
C2
http://motiwa.xyz/
Extracted
Family
redline
Botnet
Ani
C2
yaklalau.xyz:80
Extracted
Family
redline
Botnet
NewAni
C2
changidwia.xyz:80
Extracted
Path
C:\ProgramData\readme.txt
Family
conti
Ransom Note
All of your files are currently encrypted by CONTI ransomware.
If you try to use any additional recovery software - the files might be damaged or lost.
To make sure that we REALLY CAN recover data - we offer you to decrypt samples.
You can contact us for further instructions through:
Our website
TOR VERSION :
(you should download and install TOR browser first https://torproject.org)
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
HTTPS VERSION :
https://contirecovery.xyz
YOU SHOULD BE AWARE!
Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP
---BEGIN ID---
YJaSholYVyutPPmyHu1jkidZ2xceLUHCW7WzIzQQK1Gs21y5y6bqil2j0EQGGRDv
---END ID---
URLs
http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/
https://contirecovery.xyz
Extracted
Family
redline
Botnet
Cana
C2
176.111.174.254:56328
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Detect MafiaWare666 ransomware 2 IoCs
-
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 4 IoCs
-
UAC bypass 3 TTPs 3 IoCs
-
Clears Windows event logs 1 TTPs 64 IoCs
-
Detected Nirsoft tools 5 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
-
Renames multiple (153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (885) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible privilege escalation attempt 5 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings 2 TTPs 13 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 6 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 16 IoCs
-
Modifies file permissions 1 TTPs 5 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 28 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory 2 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 6 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 10 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 22 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 3 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Modifies registry class
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00446.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-2a53a4f8ab656fe75a41d55cbf54308a943fe51cdc1b92727e4e7576a0f6f274.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-2a53a4f8ab656fe75a41d55cbf54308a943fe51cdc1b92727e4e7576a0f6f274.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 11324⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-2aa3233734135a83addbaa990103cdfa1de194942ceb5a6441c87a9c048d6c51.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-2aa3233734135a83addbaa990103cdfa1de194942ceb5a6441c87a9c048d6c51.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 18724⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d06385c2dd62a844b5080c07ec41be7834445d5031dd317a61901aa44f07bd07.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-d06385c2dd62a844b5080c07ec41be7834445d5031dd317a61901aa44f07bd07.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d06385c2dd62a844b5080c07ec41be7834445d5031dd317a61901aa44f07bd07.exe" -Force4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d06385c2dd62a844b5080c07ec41be7834445d5031dd317a61901aa44f07bd07.exeC:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d06385c2dd62a844b5080c07ec41be7834445d5031dd317a61901aa44f07bd07.exe4⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-f9d2d98054b6519fc1c888e084180931a540b28db1804ebb347ea57655226a21.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-f9d2d98054b6519fc1c888e084180931a540b28db1804ebb347ea57655226a21.exe3⤵
- Executes dropped EXE
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Csqnffzcyncxkwn.vbs"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\svchost.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-f9d2d98054b6519fc1c888e084180931a540b28db1804ebb347ea57655226a21.exeC:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-f9d2d98054b6519fc1c888e084180931a540b28db1804ebb347ea57655226a21.exe4⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fa36827395f1ca463f06226a4e8c49882454ebab18496aa47953e9f332c3f990.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-fa36827395f1ca463f06226a4e8c49882454ebab18496aa47953e9f332c3f990.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\word.exe,"4⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\word.exe,"5⤵
- Modifies WinLogon for persistence
-
-
-
C:\Users\Admin\AppData\Roaming\word.exe"C:\Users\Admin\AppData\Roaming\word.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fb74489589b89dfe7fb8764b201ace33dbb4fc2de0bfef9932480df81eba3d27.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-fb74489589b89dfe7fb8764b201ace33dbb4fc2de0bfef9932480df81eba3d27.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Crypren.gen-8354814198c45fc522fe6b0665b5fe30b621d70d03ca7783c886e46736efb3c8.exeHEUR-Trojan-Ransom.MSIL.Crypren.gen-8354814198c45fc522fe6b0665b5fe30b621d70d03ca7783c886e46736efb3c8.exe3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Encoder.gen-117b0078905f0929a5da0b24e20c76bbaa99151f56789c63b4498143c2261926.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-117b0078905f0929a5da0b24e20c76bbaa99151f56789c63b4498143c2261926.exe3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System325⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32 /grant Admin:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\drivers5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\drivers /grant Admin:F5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Encoder.gen-bab1fe02b9a68e7a2a05fbb4483cb2bad9e3ad99269e90bc07ce15a01e73f93e.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-bab1fe02b9a68e7a2a05fbb4483cb2bad9e3ad99269e90bc07ce15a01e73f93e.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.MSIL.Zerber.gen-40ade8d685fe61a985df533b7515b2e707a8bc73d39b13d28d25d398e9ce3ad3.exeHEUR-Trojan-Ransom.MSIL.Zerber.gen-40ade8d685fe61a985df533b7515b2e707a8bc73d39b13d28d25d398e9ce3ad3.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 317364⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Agent.gen-cf35210dd8d4c2ba6bd50e01fcffbef66e193c06189334c59877d79d0a69756e.exeHEUR-Trojan-Ransom.Win32.Agent.gen-cf35210dd8d4c2ba6bd50e01fcffbef66e193c06189334c59877d79d0a69756e.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Blocker.gen-f43f4d8c0cae2bc83c1aa9de61ac2118a7b445f1c308103b5219a28ed8872ecd.exeHEUR-Trojan-Ransom.Win32.Blocker.gen-f43f4d8c0cae2bc83c1aa9de61ac2118a7b445f1c308103b5219a28ed8872ecd.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\Windows2.exe"C:\Users\Admin\Documents\Windows2.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\Documents\Windows.exe"C:\Users\Admin\Documents\Windows.exe"5⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\Windows.exe"C:\Users\Admin\AppData\Roaming\Windows.exe"6⤵
- Drops startup file
- Executes dropped EXE
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"7⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"7⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Windows.exe"6⤵
- Views/modifies file attributes
-
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Conti.gen-a59ace8226d8bcb7d6b9b6cf1681d2f07c5884ba5703cd5dee3b3eed76ad9841.exeHEUR-Trojan-Ransom.Win32.Conti.gen-a59ace8226d8bcb7d6b9b6cf1681d2f07c5884ba5703cd5dee3b3eed76ad9841.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-5e339b61314ed41822c0f582aeeaa72bf36af5a65027c7d6ca48d452263f00b3.exeHEUR-Trojan-Ransom.Win32.Crypmodadv.vho-5e339b61314ed41822c0f582aeeaa72bf36af5a65027c7d6ca48d452263f00b3.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Cryptor.gen-4d8fcd9492a256c0cb9567e63b53b75c2a591f5eebe7293298239736034b742a.exeHEUR-Trojan-Ransom.Win32.Cryptor.gen-4d8fcd9492a256c0cb9567e63b53b75c2a591f5eebe7293298239736034b742a.exe3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{145B8E8C-89AF-4739-8955-B50BF2E20CA2}'" delete4⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{145B8E8C-89AF-4739-8955-B50BF2E20CA2}'" delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-193efe2a36cf794a6de9dae5cf3ccc55e1409fcf503af04514df3835504cb41d.exeHEUR-Trojan-Ransom.Win32.Generic-193efe2a36cf794a6de9dae5cf3ccc55e1409fcf503af04514df3835504cb41d.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-245844af9b89e3b65126c6c8470f406c0d19d8cb85ee38a6091846efe10e3f45.exeHEUR-Trojan-Ransom.Win32.Generic-245844af9b89e3b65126c6c8470f406c0d19d8cb85ee38a6091846efe10e3f45.exe3⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-4f17d7fa344b970890ed1bc52a0da95146cab9fe56ecabafafacb0ad212558c9.exeHEUR-Trojan-Ransom.Win32.Generic-4f17d7fa344b970890ed1bc52a0da95146cab9fe56ecabafafacb0ad212558c9.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-6815e1e06e29863290319eb3e814ae2a394271aa2f95cc7c31a649c4c2f4fd04.exeHEUR-Trojan-Ransom.Win32.Generic-6815e1e06e29863290319eb3e814ae2a394271aa2f95cc7c31a649c4c2f4fd04.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-786671e532e5296a3fa765c4f35264844819f0e8d47e9c21655d8037183e2fb6.exeHEUR-Trojan-Ransom.Win32.Generic-786671e532e5296a3fa765c4f35264844819f0e8d47e9c21655d8037183e2fb6.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 4164⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-9635d1f6bacc4b9c882106cd1fe14beeb0783cdf13bc9a69288abbcb67bb8287.exeHEUR-Trojan-Ransom.Win32.Generic-9635d1f6bacc4b9c882106cd1fe14beeb0783cdf13bc9a69288abbcb67bb8287.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Generic-f661de86d9ac27f83c7a93b698b417f80de72f6ec55833e89fc43def83bc14f8.exeHEUR-Trojan-Ransom.Win32.Generic-f661de86d9ac27f83c7a93b698b417f80de72f6ec55833e89fc43def83bc14f8.exe3⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Windows\delog.cmd" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil.exe el5⤵
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe el6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "AMSI/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "AirSpaceChannel"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Application"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "DirectShowFilterGraph"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "DirectShowPluginControl"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Els_Hyphenation/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "EndpointMapper"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "FirstUXPerf-Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "ForwardedEvents"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "General Logging"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "HardwareEvents"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "IHM_DebugChannel"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Internet Explorer"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Key Management Service"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MF_MediaFoundationDeviceMFT"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MF_MediaFoundationDeviceProxy"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MF_MediaFoundationFrameServer"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MedaFoundationVideoProc"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MedaFoundationVideoProcD3D"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationAsyncWrapper"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationContentProtection"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationDS"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationDeviceProxy"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationMP4"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationMediaEngine"5⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationPerformance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationPerformanceCore"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationPipeline"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationPlatform"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "MediaFoundationSrcPrefetch"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-AppV-Client/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-AppV-Client/Debug"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-AppV-Client/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-IE/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"5⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AAD/Analytic"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AAD/Operational"5⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ADSI/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ASN1/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/General"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AllJoyn/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AllJoyn/Operational"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppHost/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"5⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppHost/Internal"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppID/Operational"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppSruProv"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Steps-Recorder"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppxPackaging/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppxPackaging/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppxPackaging/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AssignedAccess/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AssignedAccess/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AsynchronousCausality/Causality"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/GlitchDetection"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Informational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/PlaybackManager"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audit/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUser-Client"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/HCI"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Backup"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Battery/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Biometrics/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Management"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-Policy/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CAPI2/Catalog Database Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CDROM/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/ApartmentInitialize"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/ApartmentUninitialize"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/Call"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/CreateInstance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/ExtensionCatalog"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/FreeUnusedLibrary"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/RundownInstrumentation"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COMRuntime/Activations"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COMRuntime/MessageProcessing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Cleanmgr/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CloudStore/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CloudStore/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreApplication/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreApplication/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreApplication/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreWindow/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CoreWindow/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crashdump/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-CNG/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DAL-Provider/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DAL-Provider/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DAMM/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DDisplay/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DDisplay/Logging"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DLNA-Namespace/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DSC/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DSC/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DSC/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DSC/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Logging"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXP/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Data-Pdf/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deduplication/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deduplication/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deduplication/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deduplication/Scrubbing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Defrag-Core/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceAssociationService/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceConfidence/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceGuard/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceGuard/Verbose"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUpdateAgent/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Devices-Background/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D12/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D12/Logging"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D12/PerfTiming"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D9/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3DShaderCache/Default"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectComposition/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectManipulation/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Disk/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dism-Api/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dism-Api/InternalAnalytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dism-Cli/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Documents/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dot3MM/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DucUpdateAgent/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dwm-API/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dwm-Core/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dwm-Redir/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl-Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl-Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Contention"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Power"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EDP-Application-Learning/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EDP-Audit-Regular/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EDP-Audit-TCB/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EFS/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ESE/IODiagnose"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ESE/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapMethods-RasChap/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapMethods-RasTls/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapMethods-Sim/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapMethods-Ttls/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Core/WHC"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/BackupLog"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GenericRoaming/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HAL/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Help/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HotspotAuth/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HotspotAuth/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HttpService/Log"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HttpService/Trace"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IE-SmartScreen"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKE/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-Broker/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-CandidateUI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-JPAPI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-JPLMP/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-JPPRED/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-JPSetting/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-JPTIP/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-KRAPI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-KRTIP/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-OEDCompiler/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-TCCORE/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-TCTIP/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IME-TIP/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPNAT/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IdCtrls/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IdCtrls/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Input-HIDCLASS-Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-InputSwitch/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-KdsSvc/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kerberos/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/General"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-IO/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Pep/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-XDV/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Known Folders API Service"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LSA/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LSA/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LSA/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LimitsManagement/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LiveId/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LiveId/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSFTEDIT/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMC"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMR"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Media-Streaming/MDE"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Minstore/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Minstore/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Mprddm/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NTLM/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Ncasvc/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NdisImPlatform/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Ndu/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetShell/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-Connection-Broker"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-DataUsage/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-Setup/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkBridge/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProvider/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkSecurity/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkStatus/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"5⤵
- System Time Discovery
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Ntfs/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Ntfs/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Ntfs/WHC"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLE/Clipboard-Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OcpUpdateAgent/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OneBackup/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OneX/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OtpCredentialProvider/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Partition/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Partition/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PerceptionRuntime/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PerceptionSensorDataService/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PhotoAcq/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PlayToManager/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Policy/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Policy/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Power-Meter-Polling/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"5⤵
- Power Settings
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintBRM/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService-USBMon/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Privacy-Auditing/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ProcessStateManager/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Proximity-Common/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Proximity-Common/Informational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Proximity-Common/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PushNotification-Developer/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PushNotification-InProc/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RRAS/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RRAS/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RadioManager/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReFS/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Regsvr32/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RetailDemo/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RetailDemo/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Graphics/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Networking/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Web-Http/Tracing"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-WebAPI/Tracing"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime/CreateInstance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Runtime/Error"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBClient/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBClient/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBDirect/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBDirect/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBDirect/Netmon"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Audit"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Connectivity"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Performance"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBServer/Security"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Admin"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Informational"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SPB-ClassExtension/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SPB-HIDI2C/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Schannel-Events/Perf"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sdbus/Analytic"5⤵
- Clears Windows event logs
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sdbus/Debug"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sdstor/Analytic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SearchUI/Diagnostic"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SearchUI/Operational"5⤵
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SecureAssessment/Operational"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exeHEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exeHEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\59398883-78fb-4857-993d-57c7ca87e9aa" /deny *S-1-1-0:(OI)(CI)(DE,DC)5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exe"C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exe" --Admin IsNotAutoStart IsNotTask5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exe"C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-11a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165.exe" --Admin IsNotAutoStart IsNotTask6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-51857183f63638b6adc8754a06feda996571aaeb36d1e75daf4a54258bfcfd85.exeHEUR-Trojan-Ransom.Win32.Stop.gen-51857183f63638b6adc8754a06feda996571aaeb36d1e75daf4a54258bfcfd85.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\setup_install.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_1.exearnatic_1.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 280 -s 10408⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_2.exearnatic_2.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 3448⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_3.exearnatic_3.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub8⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_4.exearnatic_4.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_5.exearnatic_5.exe7⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_6.exearnatic_6.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_6.exeC:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_6.exe8⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS89774CF8\arnatic_7.exearnatic_7.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 5726⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan-Ransom.Win32.Stop.gen-923e1d37bb37118bd66462b153d9fa0d4518898ed56f0252690a6d9eb111a0d7.exeHEUR-Trojan-Ransom.Win32.Stop.gen-923e1d37bb37118bd66462b153d9fa0d4518898ed56f0252690a6d9eb111a0d7.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_1.exearnatic_1.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 10287⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_2.exearnatic_2.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 3807⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_3.exearnatic_3.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub7⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_4.exearnatic_4.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_5.exearnatic_5.exe6⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_6.exearnatic_6.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_7.exearnatic_7.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_7.exe7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_8.exe5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS05500EC8\arnatic_8.exearnatic_8.exe6⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 5685⤵
- Program crash
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-d2016a7f674319a8c642c9f6cc08244160dc469c24be65a4852a766f33aead97.exeHEUR-Trojan.MSIL.Crypt.gen-d2016a7f674319a8c642c9f6cc08244160dc469c24be65a4852a766f33aead97.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uuvGHykTdTjaUo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4BC5.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-d2016a7f674319a8c642c9f6cc08244160dc469c24be65a4852a766f33aead97.exe"{path}"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4D99.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "SCSI Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp4ED3.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-d71dcb4033372c29718b4946805429deca50ecedde74e761784917d771dc6e87.exeHEUR-Trojan.MSIL.Crypt.gen-d71dcb4033372c29718b4946805429deca50ecedde74e761784917d771dc6e87.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-d71dcb4033372c29718b4946805429deca50ecedde74e761784917d771dc6e87.exe"{path}"4⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-d7cc4b58af9e84a8ebf2c1787e0113b4b8f19744bb8c569df2737bab2b38ea35.exeHEUR-Trojan.MSIL.Crypt.gen-d7cc4b58af9e84a8ebf2c1787e0113b4b8f19744bb8c569df2737bab2b38ea35.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\owYSpn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp44C0.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-d7cc4b58af9e84a8ebf2c1787e0113b4b8f19744bb8c569df2737bab2b38ea35.exe"{path}"4⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-dc362acb50abcf57b6042a510698bae51a3454e81eb95dcf24e0f614408de6af.exeHEUR-Trojan.MSIL.Crypt.gen-dc362acb50abcf57b6042a510698bae51a3454e81eb95dcf24e0f614408de6af.exe3⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-de15c830a4501b2b14b82b7cb61ceaf4dc8c47aff2b649ec3843587b88713ac3.exeHEUR-Trojan.MSIL.Crypt.gen-de15c830a4501b2b14b82b7cb61ceaf4dc8c47aff2b649ec3843587b88713ac3.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-e3afae177119ddad9a11b1b5658d941948c10cdb813e5c26070364a46275ee85.exeHEUR-Trojan.MSIL.Crypt.gen-e3afae177119ddad9a11b1b5658d941948c10cdb813e5c26070364a46275ee85.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-e8e003992f2171cb3a00363655a00a66c73de119bdee835340507d2343857bc6.exeHEUR-Trojan.MSIL.Crypt.gen-e8e003992f2171cb3a00363655a00a66c73de119bdee835340507d2343857bc6.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-e8e003992f2171cb3a00363655a00a66c73de119bdee835340507d2343857bc6.exe"C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-e8e003992f2171cb3a00363655a00a66c73de119bdee835340507d2343857bc6.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-e9828c713815591a3ed63fa0e0782562fd8624ac1c1e4ac51795896ed75a1405.exeHEUR-Trojan.MSIL.Crypt.gen-e9828c713815591a3ed63fa0e0782562fd8624ac1c1e4ac51795896ed75a1405.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RuntmeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntmeBroker.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\RuntmeBroker.exe" "RuntmeBroker.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-ebd46183b53aca011bbd1c430296089477faf2e2130e8d9da3c633f9a38e3488.exeHEUR-Trojan.MSIL.Crypt.gen-ebd46183b53aca011bbd1c430296089477faf2e2130e8d9da3c633f9a38e3488.exe3⤵
-
-
C:\Users\Admin\Desktop\00446\HEUR-Trojan.MSIL.Crypt.gen-ed46e959fcceed5e98d0543380bfe7681ab07c5cb133a78a458e20bede55d5ba.exeHEUR-Trojan.MSIL.Crypt.gen-ed46e959fcceed5e98d0543380bfe7681ab07c5cb133a78a458e20bede55d5ba.exe3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 15041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1404 -ip 14041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2464 -ip 24641⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2852 -ip 28521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5984 -ip 59841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5392 -ip 53921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1408 -ip 14081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5364 -ip 53641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2852 -ip 28521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 280 -ip 2801⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
2Clear Windows Event Logs
1File Deletion
1Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
643B
MD5f269c0903142356da5243dbea2bd5951
SHA16a462da4f410280e45f9a5748106889ed9fc5f2d
SHA256d0f4dec3b456eaa577ef6c59250c41476554d82ce8219acfb2007b4bc4b9cf02
SHA512e1d15ce636fa9ade84f71cb962605df2ab230d51ce1f309a9ea90ac9767a93bdac597c791fbb7a0b312a102f49b5ef866996e9b7206e2a3e004b77afc82b0f22
-
Filesize
1KB
MD5ad8b61dc364c13c0e3ebccb7e228d3b5
SHA176820704cce4ecb4e5ec4a6da6bc031ea335ae9d
SHA25647ee6573ce7284929078a994ef4596463a2e3755b838dbe61c420f1799fce3b2
SHA51262544255db66592e7acd6066152f6cc7d9e3757b237ac8925d2733f945ffd6d912a9a01f9e5a9064f19198ea1779ec89e0271646ecce5b67f64545daa8a5bdf1
-
Filesize
1KB
MD5b52b7b64b4f571c200d1d661ddc7415d
SHA1dc9ba49510fa77e4a0da9b79df9e08883f8632c7
SHA2568332c111a2c1893062cc4890ab3ee5bf8117fdda911a41951916ae245e890269
SHA5124d599d556ec4290108cc81ae517bc3db0963e51eb2300c5f54c5f06b25c871ae484cba05b37549f72d847221a42b5f30800003fb77d454ae9b20cedfa1483e66
-
Filesize
33KB
MD5622582981852713ddf9bf60bf1f0b0d5
SHA112307c49a8e43f5e94ab0c9c078122d419a8b185
SHA256ad76209aab013e7959567ceb2751d610dec527d860713b52d7989a564adfd172
SHA512251ef8a6ddae54ef3c996ca848365986fff05e91db36f3f6ec4e54e2eb3287dfa1871ee06ad09be41b1d193eae9f3f65cd76b1eb487a46e09acbca23ffc3fe8e
-
Filesize
524KB
MD5f69bc4f234fac994be5b7cee458a9ab4
SHA1cfde228f63a9c75db2002535a93de7c27ec1d534
SHA256d2016a7f674319a8c642c9f6cc08244160dc469c24be65a4852a766f33aead97
SHA5124e151cd6db3852287eead8901e81fa2790dd0e1a34f109732bb64cd1be536a67b2e64d20ffc96ce5c7cf482850c44eb60434097ec8f95b4ad10487f764fab161
-
Filesize
1.8MB
MD5862108e60dc968a3712d2c1c8bf21efc
SHA1e5c0247cd23e3cbf9e45b7572e284bbd64aa0c9f
SHA256f8e62c36f08d6f7c3d5766c66cd55967a95e93efae275c53050793d70ed14cf3
SHA512ee1290e935901e6218d0fd5cfd672fa6fdc077b3bcc30e8d7b7e6df350e9400f5af3c3b24b513b8e8aa813c3117b7cee06c9349dabe9cae49952a21b613cbaa9
-
Filesize
1.8MB
MD5c8ec5b0abace0a1cb9b7d14d52620236
SHA18128b7b2d9e47609347d3c270866cb5efce6dd5e
SHA256ce122d72a23c008ed9fb2f8c427f21e47e57d760f4996a3d794546952f67a82b
SHA512c4cf2327cd4d43055f17cbd8973083d18231f480441b9920fcc286c70094a548ec9d464d2ac52ace348d47e80c42d1834ff1242085f321f618133fed7a100b91
-
Filesize
736KB
MD5381a108f36034550b0ff2af08db6ca76
SHA146916aa55ec30ba6eafd322a01d0df37d3227e21
SHA256dc99aecfc3f5b74b2aaad5103adede5db1c5af7d710a13b3e10ac16a463051ac
SHA5120b63d9838b47a85131dde62b9d84cbe0acfbbae89db71dde81f34b25ae85f63cf4f61038b7dc261207b72947dbe1ab8d6265c68cab30998dc51d111e8a219792
-
Filesize
865B
MD52563b3a7f8c6e074aad5c9b20c07f0fe
SHA1767182123e904997cf623f0aba7c56c42ef7c9ef
SHA2560ed3830a4d29338aab22afd5729b2231e1351b7df05e43b667bd8b64e96e0a5e
SHA5125b97c1e5b3b4e9f83605886312ae18026a8882e89189c9061a8b947e0126295ef6cf0983907710402a58874e32a523d6d7eb78b8246df6ce65f7b420d1fdbe25
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
196KB
MD5ad496fc24e5dcb74a04dd1ec746470e7
SHA1ffa9aa91954f2b7d5136a1d1b711e18b889475d0
SHA2566815e1e06e29863290319eb3e814ae2a394271aa2f95cc7c31a649c4c2f4fd04
SHA512e6f378fa7aefeb06a998b598481e5aea486115a404517264af0387ec253a56531547e1fa2ae8c4534c1c1419a17a1787721967a41d86ad39eeefca91d38053dc
-
Filesize
290KB
MD5ac73e0dda001f82fc284e1a706833a9b
SHA139acf7a46e9b3332a157877afffc3d950595a883
SHA256e5c6d5f578530556643c24e5ab97ccf1c9ecf1567962c09dbdb99c666a959f46
SHA512c1fbd5f3e55d241da288f465fe3875ef354b6d337f35a127f24b7e92929f45611d4d41d31e5b99627dbb51de9c7b703d8b80ede73680682d418679f9ada18f76
-
Filesize
290KB
MD587b375cb03f906fa96816a8523f6742a
SHA10ee23613b38337bea2af3758f664b00acb933317
SHA256108d29300c13545d472cb95948888b6bd92790f206b4e5d66667cfe2c6c634e3
SHA51226204ed5acf9a072d21254189eaaf9c36c512c04b3ef2cc31a52aa2fe84936c69275c4dad0c1a6362fb1a6b1f749677095becc26240223b2dbbf4074192ec8de
-
Filesize
1.5MB
MD53e0c8698d57cda4766df0470b032395e
SHA1bbb4f34b49261777e43a690476a466b0499c2698
SHA256e9828c713815591a3ed63fa0e0782562fd8624ac1c1e4ac51795896ed75a1405
SHA512f1456eb5a4431ec2bde7c012d9de995ed5dd314f1f10ac8fec7b0aa4b68ad34cfc603fe4c7943d9c5f2f6cc8e06a6ae038cd910fc0179513240a2d39aedf98e7
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5fcb37915971541a86ebf8975b0d999d8
SHA1ad0118d84b4636e0f5bc4b679cb12dc671ce33bb
SHA25657491f9dc49ccf27b4edc3ff2fd296a54e85df8f8b267ce7ed0a3d988ab527d4
SHA5123b725f52dd79696310f7ff8376a2da4b15d52c609564ee293ca8901c4c19ea4334bdc9f146c88ce1cbb9d798fb573d2d106dbd0d23c259083033e68c9abd5a0b
-
Filesize
1.2MB
MD598b66fa01fc15b6b072299d8afbb3a3e
SHA19c6fc0ced43d1888b1ca4704c53559c01502cc93
SHA2562a53a4f8ab656fe75a41d55cbf54308a943fe51cdc1b92727e4e7576a0f6f274
SHA5127c4ee579cfb46d60ac8f6bae142f8085ebb8b4431b3205e99ec5b0c93acca417116f79e485bea6ab4b563f68f9b35486eff9816c8ee84e09b2063f51e5152c8c
-
Filesize
1.3MB
MD5a9043da44dd71750acc46267e0a3b8d8
SHA1a74fc49ee0fd28e7ffa7b0fe6e1d30655ca54846
SHA2562aa3233734135a83addbaa990103cdfa1de194942ceb5a6441c87a9c048d6c51
SHA51224497ad3d496a26119d230e748dacce4e0f3e09e48c6b2fdbbcf0735a9548ba0fc99f0f0dc95674227619e1083a562d8917f2ccabd0116adb5b0b964f4cf8916
-
Filesize
5.2MB
MD58985a47a08b1f64574b2575406092b9c
SHA1174e88f678b7e0c6fde39224ad2b5508021c7e4a
SHA256d06385c2dd62a844b5080c07ec41be7834445d5031dd317a61901aa44f07bd07
SHA512c2993b182d1ec1e0bc22ec0b3b51c5a106cf60e03bd1e24503effba8d2763f055772f67b1ab2a5e0b9a737aecbb33be0752c571b21108263d029288b0fa8ef81
-
Filesize
8.7MB
MD5119624efdaa3b0f4f711c12b3c7deae4
SHA17d0d8739ef055972f3f85a52cf857fcac93b4291
SHA256f9d2d98054b6519fc1c888e084180931a540b28db1804ebb347ea57655226a21
SHA51243064f61ef80d46dafa66ad8665ba66603bc3eb8055f8f93d16f18dcdf098ac2fe7ebfe21303e45c414f2e124c346207124e758f077fa0238f26c284af1cb13e
-
Filesize
2.8MB
MD5b920b57af9c09bba72bbeea4b0a9ada9
SHA13bf24f3c2d8dd641b3cbc699220e08034a33b3b5
SHA256fa36827395f1ca463f06226a4e8c49882454ebab18496aa47953e9f332c3f990
SHA51222af1297540d7b75c600a1dca5f90bdd606ff5adae6e4232314aac4f7b74539a5493a8faa700773b200f0687a93e3554458457646bc688e3665b81f663c36a78
-
Filesize
808KB
MD583e05f3628daa2eba10e1a94f5d7a453
SHA1956d1c15a50eb8a27b5de39fa2d099cd8afb2178
SHA256fb74489589b89dfe7fb8764b201ace33dbb4fc2de0bfef9932480df81eba3d27
SHA512d382cf018b3c8a5095a39bb64d811c32f972b454b2bf00aa0b10d7176d4c712a4e784d5a321e205efa49cbbff3f8203b4a08fbce700daef605b8a0626a8fb123
-
Filesize
1.3MB
MD53de54c16cf72393175b4ede05bccadb7
SHA143350ec85092967aea46470ec886f8937bf12890
SHA2568354814198c45fc522fe6b0665b5fe30b621d70d03ca7783c886e46736efb3c8
SHA512a1891ec13f1792b4597718294e28b5a5e93d2ca093f6ae2381568fe9d4a5b05f29b1991a84a46e41f1bec0b21d9028e1f11f773e463329d908a058a3044c295a
-
Filesize
218KB
MD585d90010fed526eef947c440629b82dd
SHA11df270d02c9ea53f180130e7a219b40146cfca10
SHA256117b0078905f0929a5da0b24e20c76bbaa99151f56789c63b4498143c2261926
SHA5121455958c884f15e03531b1e836269fc6b2bab60e1a4b360e1206568ca7aabee0f55599eab4d11889359818c859d8d37d725bd90109165ca7626d045a81e75be7
-
Filesize
389KB
MD5a69fc97b5de02bc889e292dd3ab7fbba
SHA1f228b4518015f061695a981eafc93ebebfc4aa5b
SHA256bab1fe02b9a68e7a2a05fbb4483cb2bad9e3ad99269e90bc07ce15a01e73f93e
SHA5129aa463f21c299ef639026b942ff3f670ff0a0e0bbc25ac1321f3911f94de2186f1a04ca470824075cb2330222b0d6e0b13e1ac9608bbdc8fe899cf1b84fd8677
-
Filesize
100KB
MD5d70599ca4fb0aabd5f6b41ada40cdade
SHA11159d034d0b586ec11d5d277954ba966e52b6921
SHA25640ade8d685fe61a985df533b7515b2e707a8bc73d39b13d28d25d398e9ce3ad3
SHA512f1a6cd5babb8b88baad57a05397e1ed95a3be8b0b8bce0feb19806c619c4d7661101ffc5c0e73379847b03e89394d23d0f544d8e08d5dcfbf5e11641d119e2ba
-
Filesize
864KB
MD5848002588a77ebc5fa1f7c41d33613fa
SHA1bf1ac49ef253f9b5775a1831ccf2f0d7c3918d78
SHA256cf35210dd8d4c2ba6bd50e01fcffbef66e193c06189334c59877d79d0a69756e
SHA512fe617bc5e6e5b30158760fb3f689617b184da77c4ee21a29f0d988ed0c7db5ce85bb81621b6737055f0764558f1ee22950092f96f930cc98f355a292ef19bc0b
-
Filesize
1.8MB
MD5291520377b40c747c3c813a4ff1c8a07
SHA1f60f2b7095af7e399386ee1c4329cbe5de574820
SHA256f43f4d8c0cae2bc83c1aa9de61ac2118a7b445f1c308103b5219a28ed8872ecd
SHA5128a5068de11178574a0a85bb14d0a12cdcc34c1aeab952941a675c8591d0f9774294932d8b3fe4b0eecb29981c66b40f90b10247eedc765784c3447d9ae0e52c6
-
Filesize
102KB
MD585179e36fffd67b0302bbd626a8fda6a
SHA1e344db481d2a4bba886efb38f086b37a6f97cac3
SHA256a59ace8226d8bcb7d6b9b6cf1681d2f07c5884ba5703cd5dee3b3eed76ad9841
SHA512f1105896f6c654468b5877e559fc35513fb998b2edc403c09b240c8a50f06cc51c9106416d35786cc751e069e390637da977ef6c72de05c9a211c61cca2e5f71
-
Filesize
1.8MB
MD5051e8fd1ffdb1535a6e452b8f3c529ce
SHA1dcacf47390b505166fb16757c31d0ea9ea028323
SHA2565e339b61314ed41822c0f582aeeaa72bf36af5a65027c7d6ca48d452263f00b3
SHA5124895a8cc1dbffdf8ad4b82b75df5dda3b941102253dc452ef7031fbb58062322f6bd31b4b03445c46640a629db4a687b33ca5bce6caa19876812fd9b4b3e82e2
-
Filesize
196KB
MD545821ddc406490c202d13c87970aa064
SHA1de2569f4f8591fb7d56af7165360811f7a2858ff
SHA2564d8fcd9492a256c0cb9567e63b53b75c2a591f5eebe7293298239736034b742a
SHA5121240acae7caaa08e91345628dac826f4c8895671086d7327c8d7817538a415cbdb5c774b660d00981e3732f297a8b79a771f4a189b3714df1b2dfe6c41d31aed
-
Filesize
95KB
MD5663cf5193c71de9926399467965d5e33
SHA1326401d1fd7e3431520a22d136c0a6fee1b82711
SHA256193efe2a36cf794a6de9dae5cf3ccc55e1409fcf503af04514df3835504cb41d
SHA512dc8503d46e1fa32a695d041ab2f2473b8ec0e0007dfeb606c5b924e695a014a13f5b5ec37d9fd101b9ebd18c6a4467756e550920f1f9591221696afbda98d5a4
-
Filesize
3.1MB
MD54f99fe59648fdcff8c66e999252f5732
SHA1175d1ccad14d2c07058f83ffd892785093a53744
SHA256245844af9b89e3b65126c6c8470f406c0d19d8cb85ee38a6091846efe10e3f45
SHA51277b67296f8bda2be13d7e1424e504bfcdfbdb1776066797807af0b1a5982ba3ca8041d3e6cfc0756fa326271ecb64674d2f4824de5a0d90370d64c3adc1920ec
-
Filesize
196KB
MD540a5a507f169ce90ad972fb8c1feb405
SHA10b7b778ac244a82694c4bf7818bfbea44f8ce7d7
SHA2564f17d7fa344b970890ed1bc52a0da95146cab9fe56ecabafafacb0ad212558c9
SHA512d7b7ed747175fecdbf7e35e96965de7cafff78c5fd20e351e219e01312b33836a3d26d6ee90eef662b590f2a3d8a0a5c3b3bab7ac8acdea6fbb00618218bb31a
-
Filesize
2.9MB
MD598853d85195dd876c3b8cc806e0fbf8f
SHA1204b9cbc6f6b4c661dfa7b161c4dd4a01b77ac0b
SHA256786671e532e5296a3fa765c4f35264844819f0e8d47e9c21655d8037183e2fb6
SHA51234a45e6e394a9995de9b2a0a9b0ce97b0030c972cc55933297be4983460428d9ecbd74c1e2abcc000d598c07cb22d7841bf4e669ce413692450d4db6da16d9df
-
Filesize
60KB
MD5168d8c8c116edf07cef3a524e4802375
SHA18e056d0a8859311e5d8ea2f1baa389a79e6feca2
SHA2569635d1f6bacc4b9c882106cd1fe14beeb0783cdf13bc9a69288abbcb67bb8287
SHA51238881b67ef4ba544b5976d9b5ed88e06ac5f9437983790d2d04f9c3c1887c03921199b8838c0eee8065970243bee77120c16bccd9dcfbfcc93ef9352946975ec
-
Filesize
50KB
MD50eda9f10f42408424fa2f9da867b4cf4
SHA1b6a49cbe3c0459bd15e50a83e12d2c5668df921c
SHA256f661de86d9ac27f83c7a93b698b417f80de72f6ec55833e89fc43def83bc14f8
SHA512d9436990cecc9031a3a239950df5d18d7acea134781670f94478e6bc03a828d46894bc56be1c2f8f9037292d72ffae99d47b400b63415fd8ac44ef6901ce7a32
-
Filesize
890KB
MD58f39890206e57326d973881db41c639b
SHA19aa4d3da5c9af5f79294d0d8abf2f56d1d581ac3
SHA25611a5624d486d01bf1ebbf7d808524d44b26965f7e9ec89abebf75a9afc34b165
SHA5121e625b2a1e68a4acc624cb4632b1226fc2a0e52555c178a5b8e7d4011dd04be5fe57ebf64e193c2e8dfda06023044a8940556740d69882a494054ee2c8e05bd8
-
Filesize
3.2MB
MD5631005bbbc6ba0a976d109b6b20ed26d
SHA1bafbd865bb368e2613ad0e3fd42393d55b98231d
SHA25651857183f63638b6adc8754a06feda996571aaeb36d1e75daf4a54258bfcfd85
SHA512085436362ee5b826ed9cabda5037fa15c3a49d1eee34b4bc6ee7cc2a3546d54949df61daabd3916f0a0b64e79f4ad555d734aa7cefefcfe27587981e2400c082
-
Filesize
3.3MB
MD5f667ccae3ac7f9c029f3c2b788dcbddd
SHA1753981c4a273b5375503f9278d2239054982178f
SHA256923e1d37bb37118bd66462b153d9fa0d4518898ed56f0252690a6d9eb111a0d7
SHA512a18f696d0909ca31440fdd66a21ef73a79af20a844423b699badfff745d99a663f52139fe04f6789f7a93b614f36d67ad0cae494cdb708671c4c679dac998c06
-
Filesize
9KB
MD5bf7185eb9b4f309c0e2226b74a632587
SHA14efc566f7b3b9262c81129babf47e58280f17561
SHA256b4159d1689229efba10605d50d555c760ed6cc3a751003cf093dedfab9be2b64
SHA5126f09e94ffe7f2c38aea1292c0a247e80e18dc64e9d36a09e4d504e188bf3771dc0441167c36c4f3e4c402b03639e49e2e99822c85082f50dc80ab8c64392468f
-
Filesize
10KB
MD513e09776438c0d1d378471ee7cf999ed
SHA1a9c650720212074cf07872f4c7121d589cf5d568
SHA256c6339d2d13e31067d46f47be0f18acdf4eac1dbe4ad6226ce26e956956d475e8
SHA512f128cffba9f4c0207fe5606ba0302aa31d017e78f46aabb501bea2945b30eb89fb19f62b5cf8af482159e5a2cc871972f592fd4e4415d637d9594d23e0a03f63
-
Filesize
457KB
MD5fd6d0aa45eeda145b09bd41dab94f421
SHA1b222d10f9e5627994221ab65f3b538b86d4b577b
SHA2567ea6304a280fe00d58a714282f6dd4b8033ac8bbc27479aca178f816ba2cfbb9
SHA512d2418a9ff25e4cae30b6ed38c503d52fc4e840def435f973ee0ed1a34f81c3ae56d47f561de04dc9c1c55cf78291bbcb625f54061a70ed2392fd554d522a3548
-
Filesize
457KB
MD51fcfcce31737ef558c22ea617bcdc3ab
SHA1c72ff2ee6f7ad72548117848789ec39bc153dd2a
SHA256ca92d87fbe8685c461e158bac7d8781a6690c070fbe4635931dbb2d094279b9b
SHA512ecf22efcaf5b8a3c16b9cc5fb27eb1ad74cd788504bf56d20ff3174b3a8ea6b656c46b0e52475b7f51366bfbf5c45ed8eb27f637818392fc3477b48509d11c75
-
Filesize
990KB
MD5b67651ee4cbe7ace32d7c3f036862afc
SHA11b17df44a5cc53136041a049fd7a817d067a9d00
SHA2564712c08c21bd56e725a9cb84611d4fa1238f63778aaa2a743ec26df936fce175
SHA51257ba7d4bb01d6bbdaea2f981e0ce393be037c01cfa66608adb70f207daebcee4685506222cfe086f6cd44674ec1a4d1de827e88860aa50be133b408dd70b62ce
-
Filesize
990KB
MD5cf2677594b8a0120e70d2b9df8144e05
SHA134bf02c71fa16fe70dd22d437e41600cde233bad
SHA256f5898348c1efeb5c2d66a9cef9541bfa9ce732ed2ffa10066ff2978293183aee
SHA512426bde81406825365018b686aba8deffc8fd501da986a5b743c7cf056c33037b52a5b64dc6f250d7da4c23549c7dc462a59baa21df6bf55de12a7726d3eb661f
-
Filesize
27KB
MD5764c5e793bb9a8aff38dc28834fcd16f
SHA1962cea8591b49b0d4d0a726fbd1e43377f7bcde3
SHA2564decfb61a6ba23c54d2c60e4a30fb43168d9f882250092cd65931f1c7c78db6b
SHA5122fa852cda976e9abd5e2d67cb7a66d3fe3426c1a103694c37c2b4eae991bb317e831be4a705bd4a77612ae0c3d26dde9a60b3e750fa4bfd1633fc0f65861254a
-
Filesize
816KB
MD5b5e39d3f372abcb21509176468655b1a
SHA13631ef94ae14ba0f30d6edadb6a70c1ec1a09f3e
SHA2561c634803c8a81a4e7a3ec7553ed1541c6c80845f27b4baa3144b62ba613c92ec
SHA512505bfc695c561558743d1aa72feb5a0d255e14e3be27e2d9326d58a9fc44d0f6ff73d5c76c5768a1f60daa858eb5fec2b8924399771ce637a07ca1761f17d0e7
-
Filesize
1KB
MD50b51b77840a1c946a12c7065de57f8d8
SHA15aeb541defc8c52f7d4ac9c4b6f87c61ec0c4116
SHA25600220bf9e2b02e7dd7df0cb31eee447de9d0ec8314bbd017386de762f9e7d74f
SHA512864f81851bcd81afa04bce392759d7a476f7ff8df61f8e74c2edc491f06dd8002331ac2f240c856e6de7fe71f45e4aa40dd8a3aedcb75f48411449eb2e47fa93
-
Filesize
3KB
MD55c98b08fcace06fb6d98e77f232acfcb
SHA1b1a0a7248a119c34d72bf976363f733378e7b6c3
SHA256d1904bb42a101b0b863f522f398a9962dffa0da1be643d0719e15144a624e069
SHA5120e83c99cd6785f4eb01789bd81ef350849b153a2992d19fd8dcd7299cd138ddd5b1b4adda32683d6aa4224ba8c09b3d1033a14638ce2ac7dc06a0c90fac4c209
-
Filesize
248KB
-
Filesize
808KB
-
Filesize
1.7MB
-
Filesize
408KB
-
Filesize
600KB
-
Filesize
120KB
-
Filesize
88KB
-
Filesize
2.7MB
-
Filesize
1.2MB
-
Filesize
344KB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
2.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
848KB
-
Filesize
1.3MB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
5.2MB
-
Filesize
4.9MB
-
Filesize
376KB
-
Filesize
128KB
-
Filesize
24KB
-
Filesize
424KB
-
Filesize
2.9MB
-
Filesize
3.3MB
-
Filesize
2.8MB
-
Filesize
160KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
128KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
24KB
-
Filesize
144KB
-
Filesize
24KB
-
Filesize
184KB
-
Filesize
528KB
-
Filesize
32KB
-
Filesize
448KB
-
Filesize
1.7MB
-
Filesize
736KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
416KB
-
Filesize
8.7MB
-
Filesize
400KB
-
Filesize
8.6MB
-
Filesize
360KB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
1.4MB
-
Filesize
408KB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
6.1MB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
100KB
-
Filesize
140KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
136KB
-
Filesize
184KB
-
Filesize
8.4MB
-
Filesize
3.4MB
-
Filesize
10.8MB
-
Filesize
9.1MB
-
Filesize
10.8MB
-
Filesize
88KB
-
Filesize
680KB
-
Filesize
1.3MB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
24KB
-
Filesize
152KB
-
Filesize
24KB