Benign Download

62/63/6263515ff9033fd146bd89352bd0badf620d93aa038096e8be3ab32812c72089

ETW command suppresses keyword-zero eventsLogman trace update removes an ETW provider
SHA-2566263515ff9033fd146bd89352bd0badf620d93aa038096e8be3ab32812c72089
MaleculeO(Er)

Evidence

ETW command suppresses keyword-zero events lines 1–2
1Set-EtwTraceProvider -AutologgerName 'EventLog-Application' -Guid '{A0C1853B-5C40-4B15-8766-3CF1C58F985A}' -Property '0x11'
2logman.exe update trace EventLog-Application --p "Microsoft-Windows-Security-Auditing" -ets

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.