Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 14:23
Behavioral task
behavioral1
Sample
2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe
-
Size
497KB
-
MD5
569d2b5701755260514fe1563d7530bb
-
SHA1
4296b3794c3253434418f08fb933fd8a3880501e
-
SHA256
39d5df6362f22bdc4cecda164149ea0e66f93f61fe1f403f9c38666052f385ad
-
SHA512
3ddeecc152ecd8cb1a06300cbdc216e840397d2c33c4bacb9123e1e780b16ec15b2dac56ab821a576f06c42d516b9bc5876180bbb5cb3881f9a61915eec0d1f7
-
SSDEEP
6144:pgVoyb9e9BhrGcmofCJv47raqMFdIkR8492EgtuMf9opavgUnT:SGI47cIeL92EgUG9oyg
Malware Config
Signatures
-
Detect Rhysida ransomware 9 IoCs
resource yara_rule behavioral1/memory/2324-3045-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-4307-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-6429-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-8528-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-9755-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-10310-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-10311-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-10312-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida behavioral1/memory/2324-10316-0x0000000000400000-0x000000000048B000-memory.dmp family_rhysida -
Rhysida
Rhysida is a ransomware that is written in C++ and discovered in 2023.
-
Rhysida family
-
Clears Windows event logs 1 TTPs 64 IoCs
pid Process 2348 wevtutil.exe 2988 wevtutil.exe 368 wevtutil.exe 1664 wevtutil.exe 992 wevtutil.exe 2976 wevtutil.exe 560 wevtutil.exe 2256 wevtutil.exe 2172 wevtutil.exe 3040 wevtutil.exe 1604 wevtutil.exe 1560 wevtutil.exe 2428 wevtutil.exe 2320 wevtutil.exe 1828 wevtutil.exe 108 wevtutil.exe 2252 wevtutil.exe 2784 wevtutil.exe 3048 wevtutil.exe 216 wevtutil.exe 2088 wevtutil.exe 1716 wevtutil.exe 1184 wevtutil.exe 2724 wevtutil.exe 2152 wevtutil.exe 2032 wevtutil.exe 2768 wevtutil.exe 2820 wevtutil.exe 2644 wevtutil.exe 908 wevtutil.exe 2472 wevtutil.exe 1692 wevtutil.exe 1208 wevtutil.exe 3004 wevtutil.exe 1604 wevtutil.exe 2260 wevtutil.exe 2388 wevtutil.exe 2804 wevtutil.exe 2732 wevtutil.exe 396 wevtutil.exe 572 wevtutil.exe 2996 wevtutil.exe 2144 wevtutil.exe 1644 wevtutil.exe 3008 wevtutil.exe 1516 wevtutil.exe 2772 wevtutil.exe 612 wevtutil.exe 1932 wevtutil.exe 2456 wevtutil.exe 1948 wevtutil.exe 2440 wevtutil.exe 2812 wevtutil.exe 1996 wevtutil.exe 2440 wevtutil.exe 2796 wevtutil.exe 3068 wevtutil.exe 1128 wevtutil.exe 288 wevtutil.exe 2360 wevtutil.exe 2908 wevtutil.exe 2816 wevtutil.exe 1596 wevtutil.exe 2764 wevtutil.exe -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (8098) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1552 powershell.exe -
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 744 cmd.exe 2008 cmd.exe -
Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
pid Process 2008 cmd.exe 744 cmd.exe -
Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2844 wevtutil.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\bg.jpg" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Grid.eftx.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\Mozilla Firefox\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL077.XML.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\GIGGLE.WAV.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18200_.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241019.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01657_.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\THMBNAIL.PNG.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00768_.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files (x86)\Adobe\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_OFF.GIF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Tasks.accdt.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212953.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300840.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00152_.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18207_.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\Windows Journal\fr-FR\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es.pak.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN026.XML.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jre7\lib\meta-index.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\MedianReport.Dotx.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00050_.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152876.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\CriticalBreachDetected.pdf 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099173.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01268_.GIF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0229385.WMF.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_COL.HXC.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.DPV.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.rhysida 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1992 cmd.exe 272 cmd.exe 2772 PING.EXE -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2776 vssadmin.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2772 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1552 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2652 vssvc.exe Token: SeRestorePrivilege 2652 vssvc.exe Token: SeAuditPrivilege 2652 vssvc.exe Token: SeSecurityPrivilege 2600 wevtutil.exe Token: SeBackupPrivilege 2600 wevtutil.exe Token: SeSecurityPrivilege 2768 wevtutil.exe Token: SeBackupPrivilege 2768 wevtutil.exe Token: SeSecurityPrivilege 2564 wevtutil.exe Token: SeBackupPrivilege 2564 wevtutil.exe Token: SeSecurityPrivilege 2072 wevtutil.exe Token: SeBackupPrivilege 2072 wevtutil.exe Token: SeSecurityPrivilege 2084 wevtutil.exe Token: SeBackupPrivilege 2084 wevtutil.exe Token: SeSecurityPrivilege 3048 wevtutil.exe Token: SeBackupPrivilege 3048 wevtutil.exe Token: SeSecurityPrivilege 1912 wevtutil.exe Token: SeBackupPrivilege 1912 wevtutil.exe Token: SeSecurityPrivilege 2492 wevtutil.exe Token: SeBackupPrivilege 2492 wevtutil.exe Token: SeSecurityPrivilege 2076 wevtutil.exe Token: SeBackupPrivilege 2076 wevtutil.exe Token: SeSecurityPrivilege 2388 wevtutil.exe Token: SeBackupPrivilege 2388 wevtutil.exe Token: SeSecurityPrivilege 2444 wevtutil.exe Token: SeBackupPrivilege 2444 wevtutil.exe Token: SeSecurityPrivilege 2360 wevtutil.exe Token: SeBackupPrivilege 2360 wevtutil.exe Token: SeSecurityPrivilege 2700 wevtutil.exe Token: SeBackupPrivilege 2700 wevtutil.exe Token: SeSecurityPrivilege 2320 wevtutil.exe Token: SeBackupPrivilege 2320 wevtutil.exe Token: SeSecurityPrivilege 1264 wevtutil.exe Token: SeBackupPrivilege 1264 wevtutil.exe Token: SeSecurityPrivilege 2952 wevtutil.exe Token: SeBackupPrivilege 2952 wevtutil.exe Token: SeSecurityPrivilege 2808 wevtutil.exe Token: SeBackupPrivilege 2808 wevtutil.exe Token: SeSecurityPrivilege 2728 wevtutil.exe Token: SeBackupPrivilege 2728 wevtutil.exe Token: SeSecurityPrivilege 2964 wevtutil.exe Token: SeBackupPrivilege 2964 wevtutil.exe Token: SeSecurityPrivilege 2872 wevtutil.exe Token: SeBackupPrivilege 2872 wevtutil.exe Token: SeSecurityPrivilege 516 wevtutil.exe Token: SeBackupPrivilege 516 wevtutil.exe Token: SeSecurityPrivilege 2532 wevtutil.exe Token: SeBackupPrivilege 2532 wevtutil.exe Token: SeSecurityPrivilege 2928 wevtutil.exe Token: SeBackupPrivilege 2928 wevtutil.exe Token: SeSecurityPrivilege 1832 wevtutil.exe Token: SeBackupPrivilege 1832 wevtutil.exe Token: SeSecurityPrivilege 2812 wevtutil.exe Token: SeBackupPrivilege 2812 wevtutil.exe Token: SeSecurityPrivilege 2152 wevtutil.exe Token: SeBackupPrivilege 2152 wevtutil.exe Token: SeSecurityPrivilege 1596 wevtutil.exe Token: SeBackupPrivilege 1596 wevtutil.exe Token: SeSecurityPrivilege 1104 wevtutil.exe Token: SeBackupPrivilege 1104 wevtutil.exe Token: SeSecurityPrivilege 2824 wevtutil.exe Token: SeBackupPrivilege 2824 wevtutil.exe Token: SeSecurityPrivilege 2764 wevtutil.exe Token: SeBackupPrivilege 2764 wevtutil.exe Token: SeSecurityPrivilege 2032 wevtutil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2960 2324 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe 32 PID 2324 wrote to memory of 2960 2324 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe 32 PID 2324 wrote to memory of 2960 2324 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe 32 PID 2960 wrote to memory of 2912 2960 cmd.exe 34 PID 2960 wrote to memory of 2912 2960 cmd.exe 34 PID 2960 wrote to memory of 2912 2960 cmd.exe 34 PID 2912 wrote to memory of 2776 2912 cmd.exe 35 PID 2912 wrote to memory of 2776 2912 cmd.exe 35 PID 2912 wrote to memory of 2776 2912 cmd.exe 35 PID 2324 wrote to memory of 580 2324 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe 38 PID 2324 wrote to memory of 580 2324 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe 38 PID 2324 wrote to memory of 580 2324 2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe 38 PID 580 wrote to memory of 1584 580 cmd.exe 40 PID 580 wrote to memory of 1584 580 cmd.exe 40 PID 580 wrote to memory of 1584 580 cmd.exe 40 PID 1584 wrote to memory of 552 1584 cmd.exe 41 PID 1584 wrote to memory of 552 1584 cmd.exe 41 PID 1584 wrote to memory of 552 1584 cmd.exe 41 PID 552 wrote to memory of 2600 552 cmd.exe 42 PID 552 wrote to memory of 2600 552 cmd.exe 42 PID 552 wrote to memory of 2600 552 cmd.exe 42 PID 1584 wrote to memory of 2468 1584 cmd.exe 43 PID 1584 wrote to memory of 2468 1584 cmd.exe 43 PID 1584 wrote to memory of 2468 1584 cmd.exe 43 PID 1584 wrote to memory of 2768 1584 cmd.exe 44 PID 1584 wrote to memory of 2768 1584 cmd.exe 44 PID 1584 wrote to memory of 2768 1584 cmd.exe 44 PID 1584 wrote to memory of 2564 1584 cmd.exe 45 PID 1584 wrote to memory of 2564 1584 cmd.exe 45 PID 1584 wrote to memory of 2564 1584 cmd.exe 45 PID 1584 wrote to memory of 2072 1584 cmd.exe 46 PID 1584 wrote to memory of 2072 1584 cmd.exe 46 PID 1584 wrote to memory of 2072 1584 cmd.exe 46 PID 1584 wrote to memory of 2084 1584 cmd.exe 47 PID 1584 wrote to memory of 2084 1584 cmd.exe 47 PID 1584 wrote to memory of 2084 1584 cmd.exe 47 PID 1584 wrote to memory of 3048 1584 cmd.exe 48 PID 1584 wrote to memory of 3048 1584 cmd.exe 48 PID 1584 wrote to memory of 3048 1584 cmd.exe 48 PID 1584 wrote to memory of 1912 1584 cmd.exe 49 PID 1584 wrote to memory of 1912 1584 cmd.exe 49 PID 1584 wrote to memory of 1912 1584 cmd.exe 49 PID 1584 wrote to memory of 2492 1584 cmd.exe 50 PID 1584 wrote to memory of 2492 1584 cmd.exe 50 PID 1584 wrote to memory of 2492 1584 cmd.exe 50 PID 1584 wrote to memory of 2076 1584 cmd.exe 51 PID 1584 wrote to memory of 2076 1584 cmd.exe 51 PID 1584 wrote to memory of 2076 1584 cmd.exe 51 PID 1584 wrote to memory of 2388 1584 cmd.exe 52 PID 1584 wrote to memory of 2388 1584 cmd.exe 52 PID 1584 wrote to memory of 2388 1584 cmd.exe 52 PID 1584 wrote to memory of 2444 1584 cmd.exe 53 PID 1584 wrote to memory of 2444 1584 cmd.exe 53 PID 1584 wrote to memory of 2444 1584 cmd.exe 53 PID 1584 wrote to memory of 2360 1584 cmd.exe 54 PID 1584 wrote to memory of 2360 1584 cmd.exe 54 PID 1584 wrote to memory of 2360 1584 cmd.exe 54 PID 1584 wrote to memory of 2700 1584 cmd.exe 55 PID 1584 wrote to memory of 2700 1584 cmd.exe 55 PID 1584 wrote to memory of 2700 1584 cmd.exe 55 PID 1584 wrote to memory of 2320 1584 cmd.exe 56 PID 1584 wrote to memory of 2320 1584 cmd.exe 56 PID 1584 wrote to memory of 2320 1584 cmd.exe 56 PID 1584 wrote to memory of 1264 1584 cmd.exe 57 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe"1⤵
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\system32\cmd.execmd.exe /c vssadmin.exe Delete Shadows /All /Quiet3⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
PID:2776
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"2⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\system32\cmd.execmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"3⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wevtutil.exe el4⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\system32\wevtutil.exewevtutil.exe el5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Analytic"4⤵PID:2468
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Application"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DebugChannel"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DirectShowFilterGraph"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "DirectShowPluginControl"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Els_Hyphenation/Analytic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "EndpointMapper"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "ForwardedEvents"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "HardwareEvents"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Internet Explorer"4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Key Management Service"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MF_MediaFoundationDeviceProxy"4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Media Center"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationDeviceProxy"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPerformance"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPipeline"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "MediaFoundationPlatform"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IE/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IEDVTOOL/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:516
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ADSI/Debug"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-API-Tracing/Operational"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/General"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AltTab/Diagnostic"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppID/Operational"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"4⤵PID:2488
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"4⤵PID:3040
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"4⤵PID:2228
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"4⤵PID:2244
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"4⤵PID:2556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"4⤵PID:1656
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"4⤵PID:2704
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"4⤵PID:2020
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"4⤵PID:2796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"4⤵PID:3016
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"4⤵PID:2520
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"4⤵PID:2584
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Operational"4⤵PID:1208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audio/Performance"4⤵
- Clears Windows event logs
PID:572
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Audit/Analytic"4⤵PID:2920
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"4⤵PID:2900
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"4⤵PID:1144
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Backup"4⤵
- Clears Windows event logs
PID:3008
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"4⤵PID:2792
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"4⤵PID:2656
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"4⤵PID:2684
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"4⤵PID:1096
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"4⤵PID:1964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"4⤵PID:2368
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"4⤵PID:1708
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"4⤵PID:1924
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"4⤵PID:2932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"4⤵PID:2284
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"4⤵PID:1080
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"4⤵PID:3000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CDROM/Operational"4⤵PID:2280
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COM/Analytic"4⤵PID:1312
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"4⤵PID:2396
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Calculator/Debug"4⤵PID:2132
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"4⤵PID:1816
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"4⤵PID:1764
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"4⤵PID:2916
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"4⤵
- Clears Windows event logs
PID:2996
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"4⤵
- Clears Windows event logs
PID:2348
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"4⤵PID:1808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"4⤵
- Clears Windows event logs
PID:3004
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"4⤵PID:2800
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"4⤵
- Clears Windows event logs
PID:992
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"4⤵PID:2024
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"4⤵
- Clears Windows event logs
PID:2976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"4⤵PID:2416
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"4⤵
- Clears Windows event logs
PID:1516
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"4⤵PID:1192
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"4⤵PID:1088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"4⤵PID:1028
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"4⤵PID:1908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"4⤵PID:3032
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"4⤵PID:1592
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"4⤵PID:2508
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXGI/Logging"4⤵
- Clears Windows event logs
PID:108
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DXP/Analytic"4⤵PID:612
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"4⤵PID:2100
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"4⤵PID:2256
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"4⤵PID:2596
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"4⤵PID:2624
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"4⤵PID:2376
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"4⤵PID:2968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"4⤵PID:2572
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"4⤵PID:976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"4⤵PID:928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"4⤵PID:532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DhcpNap/Admin"4⤵PID:2116
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DhcpNap/Operational"4⤵PID:1728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"4⤵
- Clears Windows event logs
PID:2428
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"4⤵PID:1068
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"4⤵PID:1100
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"4⤵PID:1648
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"4⤵PID:2272
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"4⤵
- Clears Windows event logs
PID:2172
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"4⤵PID:936
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"4⤵PID:204
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"4⤵PID:216
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"4⤵PID:228
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"4⤵PID:2260
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"4⤵PID:1828
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"4⤵
- Clears Windows event logs
PID:2988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"4⤵PID:2972
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"4⤵PID:1672
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"4⤵PID:2600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"4⤵PID:1932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"4⤵PID:2496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"4⤵PID:584
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"4⤵PID:2544
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"4⤵PID:900
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"4⤵PID:1384
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"4⤵PID:2356
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"4⤵PID:1692
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"4⤵PID:2456
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"4⤵PID:2076
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"4⤵PID:2388
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"4⤵PID:2444
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"4⤵PID:2360
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"4⤵PID:2700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"4⤵
- Clears Windows event logs
PID:2320
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"4⤵PID:1264
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"4⤵PID:2952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"4⤵PID:2808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"4⤵PID:2728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"4⤵PID:2964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"4⤵PID:2432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"4⤵
- Clears Windows event logs
PID:2804
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DirectWrite/Tracing"4⤵PID:2236
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Disk/Operational"4⤵PID:2140
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"4⤵
- Clears Windows event logs
PID:2724
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"4⤵
- Clears Windows event logs
PID:2812
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"4⤵
- Clears Windows event logs
PID:2152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"4⤵PID:1596
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"4⤵PID:1104
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"4⤵PID:2824
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Documents/Performance"4⤵PID:2764
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"4⤵
- Clears Windows event logs
PID:2032
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"4⤵PID:2488
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"4⤵
- Clears Windows event logs
PID:3040
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskRingtone/Analytic"4⤵PID:1576
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"4⤵PID:2220
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EFS/Debug"4⤵
- Clears Windows event logs
PID:2732
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"4⤵PID:2736
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Debug"4⤵PID:2856
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EapHost/Operational"4⤵PID:2232
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"4⤵PID:536
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"4⤵PID:1620
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"4⤵PID:2820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"4⤵PID:276
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"4⤵PID:1904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-EventLog/Debug"4⤵PID:368
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Analytic"4⤵PID:2688
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Debug"4⤵PID:2844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FMS/Operational"4⤵PID:1196
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"4⤵PID:2672
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"4⤵PID:3068
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"4⤵PID:1772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"4⤵PID:2948
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"4⤵PID:1460
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"4⤵PID:2660
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"4⤵PID:1152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"4⤵
- Clears Windows event logs
PID:2088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GettingStarted/Diagnostic"4⤵
- Clears Windows event logs
PID:560
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"4⤵PID:2644
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HAL/Debug"4⤵PID:2316
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"4⤵PID:2984
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"4⤵PID:2064
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"4⤵PID:2748
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Help/Operational"4⤵PID:960
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"4⤵PID:1752
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"4⤵PID:2780
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"4⤵PID:2008
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"4⤵
- Clears Windows event logs
PID:1996
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"4⤵PID:744
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"4⤵PID:2364
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HotStart/Diagnostic"4⤵PID:1664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-HttpService/Trace"4⤵PID:2252
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKE/Operational"4⤵PID:524
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"4⤵PID:272
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPBusEnum/Tracing"4⤵
- Clears Windows event logs
PID:2772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"4⤵PID:1616
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"4⤵PID:2420
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-International/Operational"4⤵PID:656
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"4⤵PID:1164
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"4⤵PID:2424
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"4⤵PID:964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"4⤵PID:1968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"4⤵PID:3044
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"4⤵
- Clears Windows event logs
PID:1604
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"4⤵PID:288
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"4⤵PID:2720
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"4⤵PID:1928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"4⤵PID:1284
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"4⤵PID:2484
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"4⤵
- Clears Windows event logs
PID:2144
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Diagnostic"4⤵PID:948
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"4⤵PID:1500
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"4⤵PID:1344
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"4⤵PID:1380
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"4⤵PID:1820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"4⤵PID:932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"4⤵PID:1504
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"4⤵PID:1320
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"4⤵PID:1652
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"4⤵PID:2248
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"4⤵PID:2524
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"4⤵PID:1696
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"4⤵PID:2036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"4⤵PID:908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"4⤵PID:968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Known Folders API Service"4⤵PID:2328
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"4⤵PID:3060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"4⤵PID:208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"4⤵PID:224
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"4⤵PID:2588
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"4⤵
- Clears Windows event logs
PID:2440
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"4⤵PID:2776
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MCT/Operational"4⤵
- Clears Windows event logs
PID:1644
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"4⤵PID:2980
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"4⤵PID:896
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"4⤵PID:552
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"4⤵PID:2340
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"4⤵
- Clears Windows event logs
PID:2768
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"4⤵PID:2564
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Admin"4⤵PID:2072
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Analytic"4⤵PID:2084
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Debug"4⤵
- Clears Windows event logs
PID:3048
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MUI/Operational"4⤵PID:2516
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"4⤵PID:2492
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"4⤵PID:1920
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"4⤵PID:2612
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"4⤵PID:1600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"4⤵PID:2896
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"4⤵PID:1560
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"4⤵PID:2832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NCSI/Operational"4⤵PID:2680
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"4⤵PID:2816
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"4⤵PID:1700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"4⤵PID:3056
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NDIS/Operational"4⤵PID:2264
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NTLM/Operational"4⤵PID:2868
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"4⤵PID:2012
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"4⤵PID:1740
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetShell/Performance"4⤵PID:2512
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"4⤵PID:2648
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/Operational"4⤵PID:1832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/WHC"4⤵PID:1704
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"4⤵PID:2044
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"4⤵PID:2112
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"4⤵PID:2848
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"4⤵PID:2372
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"4⤵PID:2068
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"4⤵PID:2836
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"4⤵PID:2104
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"4⤵PID:2892
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OOBE-Machine/Diagnostic"4⤵PID:2228
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"4⤵PID:2244
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"4⤵PID:2556
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"4⤵PID:1656
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"4⤵PID:2704
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"4⤵PID:2020
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"4⤵
- Clears Windows event logs
PID:2796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"4⤵PID:1620
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"4⤵
- Clears Windows event logs
PID:2820
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"4⤵PID:2584
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PeopleNearMe/Operational"4⤵
- Clears Windows event logs
PID:2472
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"4⤵
- Clears Windows event logs
PID:368
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"4⤵PID:2688
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"4⤵
- Power Settings
PID:2844
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"4⤵PID:1196
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"4⤵PID:2672
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"4⤵
- Clears Windows event logs
PID:3068
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"4⤵PID:1772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"4⤵PID:2948
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Admin"4⤵PID:1460
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Debug"4⤵PID:2660
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-PrintService/Operational"4⤵PID:1152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"4⤵PID:2088
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"4⤵PID:560
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"4⤵
- Clears Windows event logs
PID:2644
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"4⤵PID:2316
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/Debug"4⤵PID:2984
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"4⤵PID:2064
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"4⤵PID:2748
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"4⤵PID:960
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"4⤵PID:1752
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"4⤵
- Clears Windows event logs
PID:1128
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Recovery/Operational"4⤵PID:1764
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"4⤵PID:2916
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"4⤵PID:2996
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"4⤵PID:2752
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"4⤵
- Clears Windows event logs
PID:1664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"4⤵
- Clears Windows event logs
PID:2252
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"4⤵PID:524
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"4⤵PID:272
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"4⤵PID:2772
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"4⤵PID:1616
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"4⤵PID:2420
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"4⤵PID:656
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"4⤵PID:1164
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"4⤵PID:2424
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"4⤵PID:964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"4⤵PID:1968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"4⤵PID:3044
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"4⤵
- Clears Windows event logs
PID:1604
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"4⤵
- Clears Windows event logs
PID:288
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"4⤵PID:2720
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sens/Debug"4⤵
- Clears Windows event logs
PID:612
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"4⤵PID:2100
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"4⤵
- Clears Windows event logs
PID:2256
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"4⤵PID:2596
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Setup/Analytic"4⤵PID:2624
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"4⤵PID:944
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"4⤵PID:2968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"4⤵PID:2572
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"4⤵PID:976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"4⤵PID:928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"4⤵PID:532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"4⤵PID:2976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"4⤵PID:1652
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"4⤵PID:2248
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"4⤵PID:2524
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"4⤵PID:1696
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"4⤵PID:2036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"4⤵
- Clears Windows event logs
PID:908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"4⤵PID:968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"4⤵PID:2328
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sidebar/Diagnostic"4⤵PID:3060
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"4⤵PID:208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"4⤵PID:224
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"4⤵PID:2588
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Admin"4⤵
- Clears Windows event logs
PID:2440
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Debug"4⤵PID:2776
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StickyNotes/Diagnostic"4⤵PID:1644
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"4⤵PID:2540
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-StorPort/Operational"4⤵PID:2600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"4⤵
- Clears Windows event logs
PID:1932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"4⤵PID:2496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Superfetch/Main"4⤵PID:584
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"4⤵PID:2544
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"4⤵PID:900
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"4⤵PID:1384
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"4⤵PID:1912
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"4⤵
- Clears Windows event logs
PID:1692
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"4⤵
- Clears Windows event logs
PID:2456
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"4⤵PID:2076
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"4⤵PID:2388
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"4⤵PID:2444
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"4⤵PID:2360
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"4⤵PID:2700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"4⤵PID:2788
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"4⤵PID:3052
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"4⤵PID:2944
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"4⤵PID:2808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"4⤵PID:2728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"4⤵PID:2964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"4⤵PID:2432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"4⤵PID:2804
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"4⤵PID:2532
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"4⤵PID:2904
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"4⤵
- Clears Windows event logs
PID:2784
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"4⤵PID:2712
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"4⤵PID:2876
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"4⤵PID:3036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"4⤵PID:2940
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"4⤵PID:2692
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"4⤵PID:2196
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"4⤵PID:2852
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"4⤵PID:2840
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"4⤵PID:3040
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"4⤵PID:1976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"4⤵PID:2664
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"4⤵
- Clears Windows event logs
PID:1948
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"4⤵PID:2716
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"4⤵PID:2756
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"4⤵PID:1724
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"4⤵PID:536
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"4⤵PID:2520
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"4⤵PID:2632
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"4⤵
- Clears Windows event logs
PID:1208
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-TunnelDriver"4⤵
- Clears Windows event logs
PID:2908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"4⤵PID:2920
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UAC/Operational"4⤵PID:2900
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"4⤵PID:1144
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"4⤵PID:3008
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"4⤵PID:2028
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"4⤵PID:1456
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"4⤵PID:1640
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"4⤵PID:2576
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"4⤵PID:1496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"4⤵PID:2368
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"4⤵
- Clears Windows event logs
PID:396
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"4⤵PID:1528
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"4⤵PID:2192
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"4⤵PID:2284
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"4⤵PID:1032
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceNotifications"4⤵PID:3000
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"4⤵PID:2280
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"4⤵PID:1488
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"4⤵PID:940
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VAN/Diagnostic"4⤵PID:2308
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"4⤵PID:2008
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VHDMP/Operational"4⤵PID:1996
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"4⤵PID:744
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"4⤵PID:2364
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"4⤵PID:1992
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"4⤵PID:3012
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"4⤵PID:1980
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WER-Diag/Operational"4⤵PID:2800
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WFP/Analytic"4⤵PID:1796
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WFP/Operational"4⤵PID:2024
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WLAN-AutoConfig/Operational"4⤵PID:3020
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"4⤵PID:1512
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"4⤵
- Clears Windows event logs
PID:1716
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMI-Activity/Trace"4⤵PID:988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPDMCCore/Diagnostic"4⤵PID:1788
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPDMCUI/Diagnostic"4⤵PID:1028
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"4⤵PID:1756
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"4⤵PID:2924
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WMPNSSUI/Diagnostic"4⤵PID:2880
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"4⤵PID:1636
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Operational"4⤵PID:1928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"4⤵PID:1284
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"4⤵PID:2484
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"4⤵PID:1240
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WSC-SRV/Diagnostic"4⤵PID:1396
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WUSA/Debug"4⤵PID:2344
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-MM-Events/Diagnostic"4⤵PID:2376
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic"4⤵
- Clears Windows event logs
PID:1184
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-SVC-Events/Diagnostic"4⤵PID:2268
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WWAN-UI-Events/Diagnostic"4⤵PID:1952
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WebIO-NDF/Diagnostic"4⤵PID:2148
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WebIO/Diagnostic"4⤵PID:1160
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WebServices/Tracing"4⤵PID:2976
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Concurrency"4⤵PID:1652
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Power"4⤵PID:2248
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Render"4⤵PID:2524
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/Tracing"4⤵PID:1696
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Win32k/UIPI"4⤵PID:2036
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinHTTP-NDF/Diagnostic"4⤵PID:908
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinHttp/Diagnostic"4⤵PID:968
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinINet/Analytic"4⤵PID:2328
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinRM/Analytic"4⤵PID:700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinRM/Debug"4⤵
- Clears Windows event logs
PID:216
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WinRM/Operational"4⤵PID:228
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windeploy/Analytic"4⤵
- Clears Windows event logs
PID:2260
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"4⤵
- Clears Windows event logs
PID:1828
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Defender/WHC"4⤵PID:2988
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity"4⤵PID:2972
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose"4⤵PID:1672
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"4⤵PID:2600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose"4⤵PID:1932
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsBackup/ActionCenter"4⤵PID:2496
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Debug"4⤵PID:584
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Operational"4⤵PID:2544
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Operational"4⤵PID:900
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Tracing"4⤵PID:1384
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-WindowsUpdateClient/Operational"4⤵PID:1912
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wininit/Diagnostic"4⤵PID:1920
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winlogon/Diagnostic"4⤵PID:2612
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winlogon/Operational"4⤵PID:1600
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winsock-AFD/Operational"4⤵PID:2896
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winsock-WS2HELP/Operational"4⤵
- Clears Windows event logs
PID:1560
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Winsrv/Analytic"4⤵PID:2832
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Diagnostic"4⤵PID:2680
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Operational"4⤵
- Clears Windows event logs
PID:2816
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wordpad/Admin"4⤵PID:1700
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wordpad/Debug"4⤵PID:2960
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-Wordpad/Diagnostic"4⤵PID:2808
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-mobsync/Diagnostic"4⤵PID:2728
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-ntshrui"4⤵PID:2964
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-osk/Diagnostic"4⤵PID:2432
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Microsoft-Windows-stobject/Diagnostic"4⤵PID:516
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "OAlerts"4⤵PID:2236
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Security"4⤵PID:2928
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Setup"4⤵PID:2724
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "System"4⤵PID:2812
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "TabletPC_InputPanel_Channel"4⤵PID:2152
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WINDOWS_MP4SDECD_CHANNEL"4⤵
- Clears Windows event logs
PID:1596
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WINDOWS_MSMPEG2VDEC_CHANNEL"4⤵PID:1104
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WINDOWS_WMPHOTO_CHANNEL"4⤵PID:2372
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WMPSetup"4⤵
- Clears Windows event logs
PID:2764
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "WMPSyncEngine"4⤵PID:2032
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "Windows PowerShell"4⤵PID:2488
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin"4⤵PID:2892
-
-
C:\Windows\system32\wevtutil.exewevtutil.exe cl "muxencode"4⤵PID:1976
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f2⤵PID:2556
-
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f3⤵PID:2704
-
C:\Windows\system32\reg.exereg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f4⤵PID:2756
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f2⤵PID:2232
-
C:\Windows\system32\cmd.execmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f3⤵PID:1620
-
C:\Windows\system32\reg.exereg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f4⤵PID:2520
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵PID:880
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵PID:1904
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:368
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f2⤵PID:2920
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f3⤵PID:1144
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f4⤵PID:1196
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵PID:2672
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵PID:1772
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵
- Sets desktop wallpaper using registry
PID:1640
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f2⤵PID:2948
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f3⤵PID:2660
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f4⤵PID:1924
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵PID:396
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵PID:2192
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:3024
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f2⤵PID:2316
-
C:\Windows\system32\cmd.execmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f3⤵PID:2280
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f4⤵PID:1488
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters2⤵PID:2396
-
C:\Windows\system32\rundll32.exerundll32.exe user32.dll,UpdatePerUserSystemParameters3⤵PID:1128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"2⤵
- Hide Artifacts: Hidden Window
- Indicator Removal: Clear Persistence
PID:2008 -
C:\Windows\system32\cmd.execmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"3⤵
- Hide Artifacts: Hidden Window
- Indicator Removal: Clear Persistence
PID:744 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1552 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f5⤵PID:1592
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\2024-12-25_569d2b5701755260514fe1563d7530bb_rhysida.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1992 -
C:\Windows\system32\cmd.execmd.exe /c start ping 127.0.0.1 -n 23⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:272 -
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2772
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2652
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Window
1Indicator Removal
4Clear Persistence
1Clear Windows Event Logs
1File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
111KB
MD5ae2dfed85330c48bd8a9e2f734670d6d
SHA1e2a7d9aa1996040b2161091fb3b0c4da33dba167
SHA256ab0671da428ab260b76c1ab16c0f69613b6aabeb57198bd61c8014cb3a34da20
SHA51273394b48c3707dc5925630bfb0544a5fd94691f9f3eb4d1ddc81870a35b7370f134b531b323be63ce93994be605052486742a8a37ed70fdf5dbc6a1a6d04261d