6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f

Analysis

max time kernel
118s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe
Size

54KB
MD5

c0c56f310160cb211e7e69fdf24bee43
SHA1

6279cf3d1e370444950b2c694f16e3bd7c8ec969
SHA256

6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f
SHA512

28402f4a022a0d0172ea0547011e9f344f687259f94f857a2250e916f3e83095f46d4f199fb112a10cdca7126f7cf640571595b301ef0e9e374ed067577cf572
SSDEEP

768:U+hvPV2e5loa5VIz3+hNbPQNg6OHPSnGoVrtqkql6bcIwC9t+St+:vkoi3+vPQNg6OHPCGyRq56b3hU

Score

9^/10

defense_evasion discovery evasion persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1292	Process not Found
2640	Process not Found
3472	Process not Found
4864	wevtutil.exe
2756	Process not Found
4584	Process not Found
3744	Process not Found
2208	wevtutil.exe
2392	wevtutil.exe
3048	Process not Found
1984	Process not Found
4972	Process not Found
1156	wevtutil.exe
3012	Process not Found
2992	Process not Found
2188	Process not Found
1776	Process not Found
2640	wevtutil.exe
3880	wevtutil.exe
524	Process not Found
2704	Process not Found
764	Process not Found
3612	wevtutil.exe
3124	Process not Found
2208	Process not Found
3400	Process not Found
644	Process not Found
4644	wevtutil.exe
2924	wevtutil.exe
3976	Process not Found
5000	wevtutil.exe
3900	Process not Found
1600	Process not Found
1948	Process not Found
4060	Process not Found
4720	wevtutil.exe
1604	wevtutil.exe
3652	wevtutil.exe
1612	Process not Found
1244	Process not Found
948	Process not Found
4152	wevtutil.exe
4696	wevtutil.exe
3340	wevtutil.exe
3008	wevtutil.exe
2704	wevtutil.exe
3400	Process not Found
232	Process not Found
1564	Process not Found
232	wevtutil.exe
3504	wevtutil.exe
1296	wevtutil.exe
1948	Process not Found
3640	wevtutil.exe
3744	wevtutil.exe
4756	Process not Found
3420	Process not Found
1588	wevtutil.exe
1124	wevtutil.exe
2460	wevtutil.exe
4380	Process not Found
1340	Process not Found
3784	Process not Found
4028	wevtutil.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	cleanmgr.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4892	Process not Found
3820	Process not Found

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagwrn.xml	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setupact.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\setuperr.log	cleanmgr.exe
File opened for modification	C:\Windows\system32\LogFiles\setupcln\diagerr.xml	cleanmgr.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4716	Process not Found
2568	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeManageVolumePrivilege	1032	cleanmgr.exe
Token: SeSecurityPrivilege	3092	wevtutil.exe
Token: SeBackupPrivilege	3092	wevtutil.exe
Token: SeSecurityPrivilege	2272	wevtutil.exe
Token: SeBackupPrivilege	2272	wevtutil.exe
Token: SeSecurityPrivilege	2600	wevtutil.exe
Token: SeBackupPrivilege	2600	wevtutil.exe
Token: SeSecurityPrivilege	1612	wevtutil.exe
Token: SeBackupPrivilege	1612	wevtutil.exe
Token: SeSecurityPrivilege	2580	wevtutil.exe
Token: SeBackupPrivilege	2580	wevtutil.exe
Token: SeSecurityPrivilege	2148	wevtutil.exe
Token: SeBackupPrivilege	2148	wevtutil.exe
Token: SeSecurityPrivilege	224	wevtutil.exe
Token: SeBackupPrivilege	224	wevtutil.exe
Token: SeSecurityPrivilege	1268	wevtutil.exe
Token: SeBackupPrivilege	1268	wevtutil.exe
Token: SeSecurityPrivilege	4056	wevtutil.exe
Token: SeBackupPrivilege	4056	wevtutil.exe
Token: SeSecurityPrivilege	3488	wevtutil.exe
Token: SeBackupPrivilege	3488	wevtutil.exe
Token: SeSecurityPrivilege	4792	wevtutil.exe
Token: SeBackupPrivilege	4792	wevtutil.exe
Token: SeSecurityPrivilege	4584	wevtutil.exe
Token: SeBackupPrivilege	4584	wevtutil.exe
Token: SeSecurityPrivilege	1176	wevtutil.exe
Token: SeBackupPrivilege	1176	wevtutil.exe
Token: SeSecurityPrivilege	1636	wevtutil.exe
Token: SeBackupPrivilege	1636	wevtutil.exe
Token: SeSecurityPrivilege	1808	wevtutil.exe
Token: SeBackupPrivilege	1808	wevtutil.exe
Token: SeSecurityPrivilege	1916	wevtutil.exe
Token: SeBackupPrivilege	1916	wevtutil.exe
Token: SeSecurityPrivilege	1116	wevtutil.exe
Token: SeBackupPrivilege	1116	wevtutil.exe
Token: SeSecurityPrivilege	3820	wevtutil.exe
Token: SeBackupPrivilege	3820	wevtutil.exe
Token: SeSecurityPrivilege	4164	wevtutil.exe
Token: SeBackupPrivilege	4164	wevtutil.exe
Token: SeSecurityPrivilege	916	wevtutil.exe
Token: SeBackupPrivilege	916	wevtutil.exe
Token: SeSecurityPrivilege	2924	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 208	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	84
PID 4548 wrote to memory of 208	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	84
PID 4548 wrote to memory of 208	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	84
PID 4548 wrote to memory of 2368	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	86
PID 4548 wrote to memory of 2368	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	86
PID 4548 wrote to memory of 2368	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	86
PID 4548 wrote to memory of 3904	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	88
PID 4548 wrote to memory of 3904	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	88
PID 4548 wrote to memory of 3904	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	88
PID 4548 wrote to memory of 4908	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	90
PID 4548 wrote to memory of 4908	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	90
PID 4548 wrote to memory of 4908	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	90
PID 4548 wrote to memory of 476	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	92
PID 4548 wrote to memory of 476	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	92
PID 4548 wrote to memory of 476	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	92
PID 4548 wrote to memory of 1580	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	94
PID 4548 wrote to memory of 1580	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	94
PID 4548 wrote to memory of 1580	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	94
PID 4548 wrote to memory of 472	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	96
PID 4548 wrote to memory of 472	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	96
PID 4548 wrote to memory of 472	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	96
PID 4548 wrote to memory of 2864	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	98
PID 4548 wrote to memory of 2864	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	98
PID 4548 wrote to memory of 2864	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	98
PID 4548 wrote to memory of 1236	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	100
PID 4548 wrote to memory of 1236	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	100
PID 4548 wrote to memory of 1236	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	100
PID 4548 wrote to memory of 1184	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	102
PID 4548 wrote to memory of 1184	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	102
PID 4548 wrote to memory of 1184	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	102
PID 4548 wrote to memory of 2428	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	105
PID 4548 wrote to memory of 2428	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	105
PID 4548 wrote to memory of 2428	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	105
PID 4548 wrote to memory of 216	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	107
PID 4548 wrote to memory of 216	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	107
PID 4548 wrote to memory of 216	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	107
PID 4548 wrote to memory of 2540	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	119
PID 4548 wrote to memory of 2540	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	119
PID 4548 wrote to memory of 2540	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	119
PID 4548 wrote to memory of 3656	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	121
PID 4548 wrote to memory of 3656	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	121
PID 4548 wrote to memory of 3656	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	121
PID 4548 wrote to memory of 2232	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	123
PID 4548 wrote to memory of 2232	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	123
PID 4548 wrote to memory of 2232	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	123
PID 4548 wrote to memory of 1756	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	125
PID 4548 wrote to memory of 1756	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	125
PID 4548 wrote to memory of 1756	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	125
PID 4548 wrote to memory of 3652	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	127
PID 4548 wrote to memory of 3652	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	127
PID 4548 wrote to memory of 3652	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	127
PID 4548 wrote to memory of 1388	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	129
PID 4548 wrote to memory of 1388	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	129
PID 4548 wrote to memory of 1388	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	129
PID 4548 wrote to memory of 4164	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	131
PID 4548 wrote to memory of 4164	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	131
PID 4548 wrote to memory of 4164	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	131
PID 4548 wrote to memory of 4844	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	133
PID 4548 wrote to memory of 4844	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	133
PID 4548 wrote to memory of 4844	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	133
PID 4548 wrote to memory of 4648	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	135
PID 4548 wrote to memory of 4648	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	135
PID 4548 wrote to memory of 4648	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	135
PID 4548 wrote to memory of 3492	4548	6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe	137

C:\Users\Admin\AppData\Local\Temp\6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe
"C:\Users\Admin\AppData\Local\Temp\6aa986b1611fd71775e14011ce0f4c41282953c46f8a17d9bea89072a383440f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%temp%\*.*"
  2⤵
  PID:208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%WINDIR%\temp\*.*"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c FOR /D %p IN ("%WINDIR%\temp\*") DO rmdir /s /q "%p"
  2⤵
  PID:3904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%USERPROFILE%\Downloads\*.*"
  2⤵
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%USERPROFILE%\AppData\Local\Temporary Internet Files\*.*"
  2⤵
  PID:476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Windows\Logs\CBS\*.*"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\swtools\*.*"
  2⤵
  PID:472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\drivers\*.*"
  2⤵
  PID:2864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\swsetup\"
  2⤵
  PID:1236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Windows\Prefetch\"
  2⤵
  PID:1184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%SystemRoot%\Minidump\*.dmp"
  2⤵
  PID:2428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%SystemRoot%\Memory.dmp"
  2⤵
  PID:216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%LOCALAPPDATA%\CrashDumps\*.dmp"
  2⤵
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%PROGRAMDATA%\Microsoft\Windows\WER\ReportArchive\*.*dmp"
  2⤵
  PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%PROGRAMDATA%\Microsoft\Windows\WER\ReportQueue\*.*dmp"
  2⤵
  PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%PROGRAMDATA%\Diebold\Harvester\logs\*.log"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%PROGRAMDATA%\DieboldNixdorf\packages\*.*"
  2⤵
  PID:3652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%USERPROFILE%\AppData\local\Microsoft\Windows\WER\ReportArchive\*.*dmp"
  2⤵
  PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%USERPROFILE%\AppData\local\Microsoft\Windows\WER\ReportQueue\*.*dmp"
  2⤵
  PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\LOG\*.*"
  2⤵
  PID:4844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\*.hprof"
  2⤵
  PID:4648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\hs_err_pid*.log"
  2⤵
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\FIB_1\*.*"
  2⤵
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\LOG_1\*.*"
  2⤵
  PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis TPM Utilities\logs\*.log"
  2⤵
  PID:2068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\TEK\logs\*.*"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\TrouSerS\*.*"
  2⤵
  PID:5100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis TPM Utilities\logs\*.log"
  2⤵
  PID:5112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\TEK\logs\*.*"
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\TrouSerS\*.*"
  2⤵
  PID:3892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%AIUROOT%\logs\Archive\*.*"
  2⤵
  PID:4720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\TrouSerS\*.*"
  2⤵
  PID:2588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\INVENTORY\*.*"
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\diagserv\data\*.*"
  2⤵
  PID:2580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\diagserv\log\*.*"
  2⤵
  PID:2768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\diagserv\plugins\configuration\*.*"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\diagserv\temp\*.*"
  2⤵
  PID:948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\diagserv\bin\*.hprof"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\RM4H\rm4h_certs.bin"
  2⤵
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\RM4H_0\*.*"
  2⤵
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\SELV5_CRS_0\*.*"
  2⤵
  PID:1292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\logs\*.*"
  2⤵
  PID:2128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\firmware\*.*"
  2⤵
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\XFS_RM4H_0\*.*"
  2⤵
  PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\DBD_MODULES\RM4V\GDF\*.GDF"
  2⤵
  PID:1396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\CMDV6C\cmd_v6c_certs.bin"
  2⤵
  PID:4724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c copy "%CSCROOT%\CONF\CMDV6_0\simulatedNoteTable.conf" C:\Agilis
  2⤵
  PID:836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\CMDV6_0\*.*"
  2⤵
  PID:980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c move C:\Agilis\simulatedNoteTable.conf "%CSCROOT%\CONF\CMDV6_0\"
  2⤵
  PID:476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\XFS_CMDV6C_0\*.*"
  2⤵
  PID:5036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\RM3_CRS_0\*.*"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\SELV5_CRS_0\*.*"
  2⤵
  PID:808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\channelkeys.ubr"
  2⤵
  PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\securechannel.ubr"
  2⤵
  PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c copy "%CSCROOT%\CONF\RM3_ATM_0\simulatedNoteTable.conf" C:\Agilis
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\RM3_ATM_0\*.*"
  2⤵
  PID:332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c move C:\Agilis\simulatedNoteTable.conf "%CSCROOT%\CONF\RM3_ATM_0\"
  2⤵
  PID:2200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\SELV5_ATM_0\*.*"
  2⤵
  PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\WfsCashUnits.bak"
  2⤵
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\WfsCashUnits.xml"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\WfsCdmPresentStatus.bak"
  2⤵
  PID:4200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\WfsCdmPresentStatus.xml"
  2⤵
  PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\WfsCimCashInStatus.bak"
  2⤵
  PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\WfsCimCashInStatus.xml"
  2⤵
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\securechannel_cmd.ubr"
  2⤵
  PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\RM3_CCDM_0\*.*"
  2⤵
  PID:3432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_CashUnitMemory.bak"
  2⤵
  PID:4384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_CashUnitMemory.xml"
  2⤵
  PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsCimCashInStatus.bak"
  2⤵
  PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsCimCashInStatus.xml"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsIpmMediaBinInfo.bak"
  2⤵
  PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsIpmMediaBinInfo.xml"
  2⤵
  PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsIpmStatus.bak"
  2⤵
  PID:4792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsIpmStatus.xml"
  2⤵
  PID:5036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsIpmTransStatus.bak"
  2⤵
  PID:5024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_WfsIpmTransStatus.xml"
  2⤵
  PID:1752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_SupplyReplenMem.bak"
  2⤵
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\Ccdm_SupplyReplenMem.xml"
  2⤵
  PID:4008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\CONF\*.dat"
  2⤵
  PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\tpm\restorelog.txt"
  2⤵
  PID:1276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\log\tpm\*.*"
  2⤵
  PID:1452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\TpmStatus.xml"
  2⤵
  PID:224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\KEYSTORE\tcsc\*.*"
  2⤵
  PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%CSCROOT%\VIDEO\log\*.*"
  2⤵
  PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\Security\TPM\*.*"
  2⤵
  PID:460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\sbxlog\*.*"
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\sbx\*.*"
  2⤵
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\sbxarchives\*.*"
  2⤵
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\logs\*.*"
  2⤵
  PID:4168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\vcs\logs\*.*"
  2⤵
  PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\EDC\EDCLocal.dat"
  2⤵
  PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\Archive\*.*"
  2⤵
  PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\WinSetup\MS_FOD\*.*"
  2⤵
  PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Diebold\WinSetup\MS_Updates\Updates-x64\*.*"
  2⤵
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\ABC\message.trc"
  2⤵
  PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis EmPower\Local\Netdata\FITtable.xml"
  2⤵
  PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis EmPower\Local\Netdata\States\States.xml"
  2⤵
  PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis EmPower\States\*.*"
  2⤵
  PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis EmPower\Local\Netdata\FITtable.xml"
  2⤵
  PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis EmPower\Local\Netdata\States\States.xml"
  2⤵
  PID:3092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis EmPower\States\*.*"
  2⤵
  PID:3240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\ABC\message.trc"
  2⤵
  PID:3420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis EmPower\PrintOutput\*.*"
  2⤵
  PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis EmPower\PrintOutput\*.*"
  2⤵
  PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\AMI\AMITRACE\*.*"
  2⤵
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\AMI\AMITRACE\*.*"
  2⤵
  PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis EmPower\Config\ExCICounts.xml"
  2⤵
  PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles(x86)%\Diebold\Agilis EmPower\Config\FaulHistory.dat"
  2⤵
  PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis EmPower\Config\ExCICounts.xml"
  2⤵
  PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%ProgramFiles%\Diebold\Agilis EmPower\Config\FaulHistory.dat"
  2⤵
  PID:2644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c trcwclr error
  2⤵
  PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c trcwclr trace
  2⤵
  PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q "%systemdrive%\Agilis\Logs\*.*"
  2⤵
  PID:444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c cleanmgr.exe /s /q /sagerun
  2⤵
  PID:4200
- - C:\Windows\SysWOW64\cleanmgr.exe
    cleanmgr.exe /s /q /sagerun
    3⤵
    - Enumerates connected drives
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c del /s /q %systemdrive%\$Recycle.bin
  2⤵
  PID:1408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe el
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl AMSI/Debug
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl AMSI/Debug
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl AirSpaceChannel
  2⤵
  PID:464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl AirSpaceChannel
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Analytic
  2⤵
  PID:164
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Analytic
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Application
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Application
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl DirectShowFilterGraph
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl DirectShowFilterGraph
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl DirectShowPluginControl
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl DirectShowPluginControl
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Els_Hyphenation/Analytic
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Els_Hyphenation/Analytic
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl EndpointMapper
  2⤵
  - System Location Discovery: System Language Discovery
  PID:100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl EndpointMapper
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl FirstUXPerf-Analytic
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl FirstUXPerf-Analytic
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl ForwardedEvents
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl ForwardedEvents
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl General Logging
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl General Logging
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl HardwareEvents
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl HardwareEvents
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl IHM_DebugChannel
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl IHM_DebugChannel
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Intel-iaLPSS-GPIO/Analytic
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Intel-iaLPSS-GPIO/Analytic
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Intel-iaLPSS-I2C/Analytic
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Intel-iaLPSS-I2C/Analytic
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Intel-iaLPSS2-GPIO2/Debug
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Intel-iaLPSS2-GPIO2/Debug
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Intel-iaLPSS2-GPIO2/Performance
  2⤵
  PID:3020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Intel-iaLPSS2-GPIO2/Performance
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Intel-iaLPSS2-I2C/Debug
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Intel-iaLPSS2-I2C/Debug
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Intel-iaLPSS2-I2C/Performance
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Intel-iaLPSS2-I2C/Performance
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Internet Explorer
  2⤵
  PID:2068
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Internet Explorer
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Key Management Service
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Key Management Service
    3⤵
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MF_MediaFoundationDeviceMFT
  2⤵
  PID:1152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MF_MediaFoundationDeviceMFT
    3⤵
    PID:3172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MF_MediaFoundationDeviceProxy
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MF_MediaFoundationDeviceProxy
    3⤵
    PID:1020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MF_MediaFoundationFrameServer
  2⤵
  PID:332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MF_MediaFoundationFrameServer
    3⤵
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MedaFoundationVideoProc
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MedaFoundationVideoProc
    3⤵
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MedaFoundationVideoProcD3D
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MedaFoundationVideoProcD3D
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationAsyncWrapper
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationAsyncWrapper
    3⤵
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationContentProtection
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationContentProtection
    3⤵
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationDS
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationDS
    3⤵
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationDeviceProxy
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationDeviceProxy
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationMP4
  2⤵
  PID:2792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationMP4
    3⤵
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationMediaEngine
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationMediaEngine
    3⤵
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationPerformance
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationPerformance
    3⤵
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationPerformanceCore
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationPerformanceCore
    3⤵
    - Clears Windows event logs
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationPipeline
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationPipeline
    3⤵
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationPlatform
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationPlatform
    3⤵
    PID:1116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl MediaFoundationSrcPrefetch
  2⤵
  PID:3944
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl MediaFoundationSrcPrefetch
    3⤵
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-AppV-Client-Streamingux/Debug
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-AppV-Client-Streamingux/Debug
    3⤵
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-AppV-Client/Admin
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-AppV-Client/Admin
    3⤵
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-AppV-Client/Debug
  2⤵
  PID:2220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-AppV-Client/Debug
    3⤵
    - Clears Windows event logs
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-AppV-Client/Operational
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-AppV-Client/Operational
    3⤵
    PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-AppV-Client/Virtual Applications
  2⤵
  PID:1412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-AppV-Client/Virtual Applications
    3⤵
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-AppV-SharedPerformance/Analytic
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3048
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-AppV-SharedPerformance/Analytic
    3⤵
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Client-Licensing-Platform/Admin
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Client-Licensing-Platform/Admin
    3⤵
    PID:164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Client-Licensing-Platform/Debug
  2⤵
  PID:332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Client-Licensing-Platform/Debug
    3⤵
    - Clears Windows event logs
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Client-Licensing-Platform/Diagnostic
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Client-Licensing-Platform/Diagnostic
    3⤵
    PID:364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-IE/Diagnostic
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-IE/Diagnostic
    3⤵
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-IEFRAME/Diagnostic
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-IEFRAME/Diagnostic
    3⤵
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-JSDumpHeap/Diagnostic
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-JSDumpHeap/Diagnostic
    3⤵
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-OneCore-Setup/Analytic
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-OneCore-Setup/Analytic
    3⤵
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-PerfTrack-IEFRAME/Diagnostic
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-PerfTrack-IEFRAME/Diagnostic
    3⤵
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-PerfTrack-MSHTML/Diagnostic
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-PerfTrack-MSHTML/Diagnostic
    3⤵
    PID:3400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-Admin/Debug
  2⤵
  PID:3616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-Admin/Debug
    3⤵
    PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-Agent Driver/Debug
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-Agent Driver/Debug
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-Agent Driver/Operational
  2⤵
  PID:644
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-Agent Driver/Operational
    3⤵
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-App Agent/Analytic
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-App Agent/Analytic
    3⤵
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-App Agent/Debug
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-App Agent/Debug
    3⤵
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-App Agent/Operational
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-App Agent/Operational
    3⤵
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-IPC/Operational
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-IPC/Operational
    3⤵
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-SQM Uploader/Analytic
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-SQM Uploader/Analytic
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-SQM Uploader/Debug
  2⤵
  PID:2220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-SQM Uploader/Debug
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-User Experience Virtualization-SQM Uploader/Operational
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-User Experience Virtualization-SQM Uploader/Operational
    3⤵
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AAD/Analytic
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AAD/Analytic
    3⤵
    PID:3212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AAD/Operational
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AAD/Operational
    3⤵
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ADSI/Debug
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ADSI/Debug
    3⤵
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ASN1/Operational
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ASN1/Operational
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ATAPort/General
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ATAPort/General
    3⤵
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ATAPort/SATA-LPM
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ATAPort/SATA-LPM
    3⤵
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ActionQueue/Analytic
  2⤵
  PID:1452
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ActionQueue/Analytic
    3⤵
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-All-User-Install-Agent/Admin
  2⤵
  PID:1628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-All-User-Install-Agent/Admin
    3⤵
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AllJoyn/Debug
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4168
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AllJoyn/Debug
    3⤵
    - Clears Windows event logs
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AllJoyn/Operational
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AllJoyn/Operational
    3⤵
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppHost/Admin
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppHost/Admin
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppHost/ApplicationTracing
  2⤵
  PID:524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppHost/ApplicationTracing
    3⤵
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppHost/Diagnostic
  2⤵
  PID:3576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppHost/Diagnostic
    3⤵
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppHost/Internal
  2⤵
  PID:644
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppHost/Internal
    3⤵
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppID/Operational
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppID/Operational
    3⤵
    PID:2256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppLocker/EXE and DLL
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppLocker/EXE and DLL
    3⤵
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppLocker/MSI and Script
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppLocker/MSI and Script
    3⤵
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppLocker/Packaged app-Deployment
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppLocker/Packaged app-Deployment
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppLocker/Packaged app-Execution
  2⤵
  PID:916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppLocker/Packaged app-Execution
    3⤵
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Admin
  2⤵
  PID:444
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Admin
    3⤵
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Analytic
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Analytic
    3⤵
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Debug
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Debug
    3⤵
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Diagnostics
  2⤵
  PID:3984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppModel-Runtime/Diagnostics
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppModel-State/Debug
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppModel-State/Debug
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppModel-State/Diagnostic
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppModel-State/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppReadiness/Admin
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppReadiness/Admin
    3⤵
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppReadiness/Debug
  2⤵
  PID:2120
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppReadiness/Debug
    3⤵
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppReadiness/Operational
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppReadiness/Operational
    3⤵
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppSruProv
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppSruProv
    3⤵
    PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppXDeployment/Diagnostic
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppXDeployment/Diagnostic
    3⤵
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppXDeployment/Operational
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppXDeployment/Operational
    3⤵
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Debug
  2⤵
  PID:3900
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Debug
    3⤵
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Diagnostic
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Diagnostic
    3⤵
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Operational
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Operational
    3⤵
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Restricted
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppXDeploymentServer/Restricted
    3⤵
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ApplicabilityEngine/Analytic
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ApplicabilityEngine/Analytic
    3⤵
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ApplicabilityEngine/Operational
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ApplicabilityEngine/Operational
    3⤵
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Admin
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Admin
    3⤵
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Analytic
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Analytic
    3⤵
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Debug
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Debug
    3⤵
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Operational
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application Server-Applications/Operational
    3⤵
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug
    3⤵
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
    3⤵
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic
    3⤵
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace
    3⤵
    - Clears Windows event logs
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
  2⤵
  PID:948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
    3⤵
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Inventory
  2⤵
  PID:4084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Inventory
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Telemetry
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Program-Telemetry
    3⤵
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Application-Experience/Steps-Recorder
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Application-Experience/Steps-Recorder
    3⤵
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppxPackaging/Debug
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppxPackaging/Debug
    3⤵
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppxPackaging/Operational
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppxPackaging/Operational
    3⤵
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AppxPackaging/Performance
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AppxPackaging/Performance
    3⤵
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AssignedAccess/Admin
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AssignedAccess/Admin
    3⤵
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AssignedAccess/Operational
  2⤵
  PID:1236
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AssignedAccess/Operational
    3⤵
    - Clears Windows event logs
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AssignedAccessBroker/Admin
  2⤵
  PID:3540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AssignedAccessBroker/Admin
    3⤵
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AssignedAccessBroker/Operational
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AssignedAccessBroker/Operational
    3⤵
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AsynchronousCausality/Causality
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AsynchronousCausality/Causality
    3⤵
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audio/CaptureMonitor
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audio/CaptureMonitor
    3⤵
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audio/GlitchDetection
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audio/GlitchDetection
    3⤵
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audio/Informational
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audio/Informational
    3⤵
    PID:4720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audio/Operational
  2⤵
  PID:212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audio/Operational
    3⤵
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audio/Performance
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audio/Performance
    3⤵
    PID:4256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audio/PlaybackManager
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audio/PlaybackManager
    3⤵
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Audit/Analytic
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Audit/Analytic
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Authentication User Interface/Operational
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Authentication User Interface/Operational
    3⤵
    - Clears Windows event logs
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
    3⤵
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Authentication/ProtectedUser-Client
  2⤵
  PID:216
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Authentication/ProtectedUser-Client
    3⤵
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
  2⤵
  PID:5104
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
    3⤵
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
    3⤵
    - Clears Windows event logs
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-AxInstallService/Log
  2⤵
  PID:1156
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-AxInstallService/Log
    3⤵
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BTH-BTHPORT/HCI
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BTH-BTHPORT/HCI
    3⤵
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BTH-BTHPORT/L2CAP
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BTH-BTHPORT/L2CAP
    3⤵
    - Clears Windows event logs
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BTH-BTHUSB/Diagnostic
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BTH-BTHUSB/Diagnostic
    3⤵
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BTH-BTHUSB/Performance
  2⤵
  PID:1752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BTH-BTHUSB/Performance
    3⤵
    PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic
    3⤵
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BackgroundTaskInfrastructure/Operational
  2⤵
  PID:4040
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BackgroundTaskInfrastructure/Operational
    3⤵
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
    3⤵
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Backup
  2⤵
  PID:1668
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Backup
    3⤵
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
    3⤵
    PID:208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
    3⤵
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Battery/Diagnostic
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Battery/Diagnostic
    3⤵
    PID:2524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Biometrics/Analytic
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Biometrics/Analytic
    3⤵
    PID:3220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Biometrics/Operational
  2⤵
  PID:1072
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Biometrics/Operational
    3⤵
    PID:4020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
    3⤵
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
    3⤵
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BitLocker-Driver-Performance/Operational
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BitLocker-Driver-Performance/Operational
    3⤵
    PID:164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BitLocker/BitLocker Management
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BitLocker/BitLocker Management
    3⤵
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BitLocker/BitLocker Operational
  2⤵
  PID:3688
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BitLocker/BitLocker Operational
    3⤵
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BitLocker/Tracing
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BitLocker/Tracing
    3⤵
    PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Bits-Client/Analytic
  2⤵
  PID:456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Bits-Client/Analytic
    3⤵
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Bits-Client/Operational
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Bits-Client/Operational
    3⤵
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational
  2⤵
  PID:4132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational
    3⤵
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Bluetooth-Bthmini/Operational
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Bluetooth-Bthmini/Operational
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Bluetooth-MTPEnum/Operational
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Bluetooth-MTPEnum/Operational
    3⤵
    PID:1292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Bluetooth-Policy/Operational
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Bluetooth-Policy/Operational
    3⤵
    PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BranchCache/Operational
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BranchCache/Operational
    3⤵
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BranchCacheEventProvider/Diagnostic
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BranchCacheEventProvider/Diagnostic
    3⤵
    PID:472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BranchCacheMonitoring/Analytic
  2⤵
  PID:1032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BranchCacheMonitoring/Analytic
    3⤵
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BranchCacheSMB/Analytic
  2⤵
  PID:3492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BranchCacheSMB/Analytic
    3⤵
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-BranchCacheSMB/Operational
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-BranchCacheSMB/Operational
    3⤵
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CAPI2/Catalog Database Debug
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CAPI2/Catalog Database Debug
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CAPI2/Operational
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CAPI2/Operational
    3⤵
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CDROM/Operational
  2⤵
  PID:4448
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CDROM/Operational
    3⤵
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/Analytic
  2⤵
  PID:3504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/Analytic
    3⤵
    PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/ApartmentInitialize
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/ApartmentInitialize
    3⤵
    PID:3624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/ApartmentUninitialize
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/ApartmentUninitialize
    3⤵
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/Call
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/Call
    3⤵
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/CreateInstance
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/CreateInstance
    3⤵
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/ExtensionCatalog
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/ExtensionCatalog
    3⤵
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/FreeUnusedLibrary
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/FreeUnusedLibrary
    3⤵
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COM/RundownInstrumentation
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COM/RundownInstrumentation
    3⤵
    PID:2248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COMRuntime/Activations
  2⤵
  PID:1300
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COMRuntime/Activations
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COMRuntime/MessageProcessing
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COMRuntime/MessageProcessing
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-COMRuntime/Tracing
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-COMRuntime/Tracing
    3⤵
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CertPoleEng/Operational
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CertPoleEng/Operational
    3⤵
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
    3⤵
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
    3⤵
    PID:3400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
  2⤵
  PID:3972
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
    3⤵
    - Clears Windows event logs
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Cleanmgr/Diagnostic
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Cleanmgr/Diagnostic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ClearTypeTextTuner/Diagnostic
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ClearTypeTextTuner/Diagnostic
    3⤵
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CloudStore/Debug
  2⤵
  PID:2096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CloudStore/Debug
    3⤵
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CloudStore/Operational
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CloudStore/Operational
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CmiSetup/Analytic
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CmiSetup/Analytic
    3⤵
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CodeIntegrity/Operational
  2⤵
  PID:2372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CodeIntegrity/Operational
    3⤵
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CodeIntegrity/Verbose
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CodeIntegrity/Verbose
    3⤵
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ComDlg32/Analytic
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ComDlg32/Analytic
    3⤵
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ComDlg32/Debug
  2⤵
  PID:4388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ComDlg32/Debug
    3⤵
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Compat-Appraiser/Analytic
  2⤵
  PID:4520
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Compat-Appraiser/Analytic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Compat-Appraiser/Operational
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Compat-Appraiser/Operational
    3⤵
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Containers-BindFlt/Debug
  2⤵
  PID:5004
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Containers-BindFlt/Debug
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Containers-BindFlt/Operational
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Containers-BindFlt/Operational
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Containers-Wcifs/Debug
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Containers-Wcifs/Debug
    3⤵
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Containers-Wcifs/Operational
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Containers-Wcifs/Operational
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Containers-Wcnfs/Debug
  2⤵
  PID:3512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Containers-Wcnfs/Debug
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Containers-Wcnfs/Operational
  2⤵
  PID:856
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Containers-Wcnfs/Operational
    3⤵
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreApplication/Diagnostic
  2⤵
  PID:632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreApplication/Diagnostic
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreApplication/Operational
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreApplication/Operational
    3⤵
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreApplication/Tracing
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreApplication/Tracing
    3⤵
    PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug
  2⤵
  PID:1848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational
    3⤵
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreWindow/Analytic
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreWindow/Analytic
    3⤵
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CoreWindow/Debug
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CoreWindow/Debug
    3⤵
    PID:524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CorruptedFileRecovery-Client/Operational
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CorruptedFileRecovery-Client/Operational
    3⤵
    PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CorruptedFileRecovery-Server/Operational
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CorruptedFileRecovery-Server/Operational
    3⤵
    PID:1116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crashdump/Operational
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crashdump/Operational
    3⤵
    - Clears Windows event logs
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-CredUI/Diagnostic
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-CredUI/Diagnostic
    3⤵
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-BCRYPT/Analytic
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-BCRYPT/Analytic
    3⤵
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-CNG/Analytic
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-CNG/Analytic
    3⤵
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
    3⤵
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-DPAPI/Debug
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-DPAPI/Debug
    3⤵
    PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-DPAPI/Operational
  2⤵
  PID:2232
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-DPAPI/Operational
    3⤵
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-DSSEnh/Analytic
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-DSSEnh/Analytic
    3⤵
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-NCrypt/Operational
  2⤵
  PID:948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-NCrypt/Operational
    3⤵
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-RNG/Analytic
  2⤵
  PID:456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-RNG/Analytic
    3⤵
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Crypto-RSAEnh/Analytic
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Crypto-RSAEnh/Analytic
    3⤵
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-D3D10Level9/Analytic
  2⤵
  PID:460
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-D3D10Level9/Analytic
    3⤵
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-D3D10Level9/PerfTiming
  2⤵
  PID:2112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-D3D10Level9/PerfTiming
    3⤵
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DAL-Provider/Analytic
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DAL-Provider/Analytic
    3⤵
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DAL-Provider/Operational
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DAL-Provider/Operational
    3⤵
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DAMM/Diagnostic
  2⤵
  PID:344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DAMM/Diagnostic
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DCLocator/Debug
  2⤵
  PID:1124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DCLocator/Debug
    3⤵
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DDisplay/Analytic
  2⤵
  PID:472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DDisplay/Analytic
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DDisplay/Logging
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DDisplay/Logging
    3⤵
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DLNA-Namespace/Analytic
  2⤵
  PID:3616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DLNA-Namespace/Analytic
    3⤵
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DNS-Client/Operational
  2⤵
  - System Location Discovery: System Language Discovery
  PID:764
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DNS-Client/Operational
    3⤵
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DSC/Admin
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DSC/Admin
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DSC/Analytic
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DSC/Analytic
    3⤵
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DSC/Debug
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DSC/Debug
    3⤵
    PID:3108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DSC/Operational
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DSC/Operational
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DUI/Diagnostic
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DUI/Diagnostic
    3⤵
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DUSER/Diagnostic
  2⤵
  PID:1412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DUSER/Diagnostic
    3⤵
    PID:1556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DXGI/Analytic
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DXGI/Analytic
    3⤵
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DXGI/Logging
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DXGI/Logging
    3⤵
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DXP/Analytic
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DXP/Analytic
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Data-Pdf/Debug
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Data-Pdf/Debug
    3⤵
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DataIntegrityScan/Admin
  2⤵
  PID:332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DataIntegrityScan/Admin
    3⤵
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DataIntegrityScan/CrashRecovery
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DataIntegrityScan/CrashRecovery
    3⤵
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DateTimeControlPanel/Analytic
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DateTimeControlPanel/Analytic
    3⤵
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DateTimeControlPanel/Debug
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DateTimeControlPanel/Debug
    3⤵
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DateTimeControlPanel/Operational
  2⤵
  PID:4536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DateTimeControlPanel/Operational
    3⤵
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Deduplication/Diagnostic
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Deduplication/Diagnostic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Deduplication/Operational
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Deduplication/Operational
    3⤵
    PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Deduplication/Performance
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Deduplication/Performance
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Deduplication/Scrubbing
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Deduplication/Scrubbing
    3⤵
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Defrag-Core/Debug
  2⤵
  PID:1860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Defrag-Core/Debug
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Deplorch/Analytic
  2⤵
  PID:1032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Deplorch/Analytic
    3⤵
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DesktopActivityModerator/Diagnostic
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DesktopActivityModerator/Diagnostic
    3⤵
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic
    3⤵
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceAssociationService/Performance
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceAssociationService/Performance
    3⤵
    - Clears Windows event logs
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceConfidence/Analytic
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceConfidence/Analytic
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceGuard/Operational
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceGuard/Operational
    3⤵
    - Clears Windows event logs
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceGuard/Verbose
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceGuard/Verbose
    3⤵
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
  2⤵
  PID:1556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
    3⤵
    PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug
  2⤵
  PID:1152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug
    3⤵
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Admin
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Admin
    3⤵
    PID:216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Analytic
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Analytic
    3⤵
    PID:1272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Debug
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Debug
    3⤵
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Operational
  2⤵
  PID:232
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceSetupManager/Operational
    3⤵
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceSync/Analytic
  2⤵
  PID:224
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceSync/Analytic
    3⤵
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceSync/Operational
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceSync/Operational
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceUpdateAgent/Operational
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceUpdateAgent/Operational
    3⤵
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceUx/Informational
  2⤵
  PID:1292
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceUx/Informational
    3⤵
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DeviceUx/Performance
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DeviceUx/Performance
    3⤵
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Devices-Background/Operational
  2⤵
  PID:3700
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Devices-Background/Operational
    3⤵
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dhcp-Client/Admin
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dhcp-Client/Admin
    3⤵
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dhcp-Client/Operational
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dhcp-Client/Operational
    3⤵
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dhcpv6-Client/Admin
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dhcpv6-Client/Admin
    3⤵
    PID:5048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dhcpv6-Client/Operational
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dhcpv6-Client/Operational
    3⤵
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DiagCpl/Debug
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DiagCpl/Debug
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic
  2⤵
  PID:4648
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic
    3⤵
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-DPS/Analytic
  2⤵
  PID:3816
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-DPS/Analytic
    3⤵
    PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-DPS/Debug
  2⤵
  PID:4720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-DPS/Debug
    3⤵
    PID:4844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-DPS/Operational
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-DPS/Operational
    3⤵
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-MSDE/Debug
  2⤵
  PID:3996
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-MSDE/Debug
    3⤵
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-PCW/Analytic
  2⤵
  PID:5084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-PCW/Analytic
    3⤵
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-PCW/Debug
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-PCW/Debug
    3⤵
    PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-PCW/Operational
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-PCW/Operational
    3⤵
    PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-PLA/Debug
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-PLA/Debug
    3⤵
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-PLA/Operational
  2⤵
  PID:456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-PLA/Operational
    3⤵
    - System Location Discovery: System Language Discovery
    PID:364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-Perfhost/Analytic
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-Perfhost/Analytic
    3⤵
    PID:1452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-Scheduled/Operational
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-Scheduled/Operational
    3⤵
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Admin
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Admin
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Analytic
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Analytic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Debug
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Debug
    3⤵
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Operational
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-Scripted/Operational
    3⤵
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug
    3⤵
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
    3⤵
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-WDC/Analytic
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-WDC/Analytic
    3⤵
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnosis-WDI/Debug
  2⤵
  PID:4400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnosis-WDI/Debug
    3⤵
    PID:3792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-Networking/Debug
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-Networking/Debug
    3⤵
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-Networking/Operational
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-Networking/Operational
    3⤵
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic
    3⤵
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-Performance/Diagnostic
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-Performance/Diagnostic
    3⤵
    PID:4000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
    3⤵
    PID:1412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Diagnostics-Performance/Operational
  2⤵
  PID:1940
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Diagnostics-Performance/Operational
    3⤵
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D10/Analytic
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D10/Analytic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D10_1/Analytic
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D10_1/Analytic
    3⤵
    PID:1020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D11/Analytic
  2⤵
  PID:1612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D11/Analytic
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D11/Logging
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D11/Logging
    3⤵
    PID:872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D11/PerfTiming
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D11/PerfTiming
    3⤵
    PID:1276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D12/Analytic
  2⤵
  PID:1388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D12/Analytic
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D12/Logging
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D12/Logging
    3⤵
    - Clears Windows event logs
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D12/PerfTiming
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D12/PerfTiming
    3⤵
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3D9/Analytic
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3D9/Analytic
    3⤵
    PID:2112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Direct3DShaderCache/Default
  2⤵
  PID:2208
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Direct3DShaderCache/Default
    3⤵
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DirectComposition/Diagnostic
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DirectComposition/Diagnostic
    3⤵
    PID:60
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DirectManipulation/Diagnostic
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DirectManipulation/Diagnostic
    3⤵
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DirectShow-KernelSupport/Performance
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DirectShow-KernelSupport/Performance
    3⤵
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DirectSound/Debug
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DirectSound/Debug
    3⤵
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Disk/Operational
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Disk/Operational
    3⤵
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DiskDiagnostic/Operational
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DiskDiagnostic/Operational
    3⤵
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DiskDiagnosticDataCollector/Operational
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DiskDiagnosticDataCollector/Operational
    3⤵
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DiskDiagnosticResolver/Operational
  2⤵
  PID:208
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DiskDiagnosticResolver/Operational
    3⤵
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dism-Api/Analytic
  2⤵
  PID:2540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dism-Api/Analytic
    3⤵
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dism-Api/ExternalAnalytic
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dism-Api/ExternalAnalytic
    3⤵
    PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dism-Api/InternalAnalytic
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dism-Api/InternalAnalytic
    3⤵
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dism-Cli/Analytic
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dism-Cli/Analytic
    3⤵
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DisplayColorCalibration/Debug
  2⤵
  PID:3092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DisplayColorCalibration/Debug
    3⤵
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DisplayColorCalibration/Operational
  2⤵
  PID:464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DisplayColorCalibration/Operational
    3⤵
    PID:444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DisplaySwitch/Diagnostic
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DisplaySwitch/Diagnostic
    3⤵
    PID:412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Documents/Performance
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Documents/Performance
    3⤵
    PID:676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dot3MM/Diagnostic
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dot3MM/Diagnostic
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DriverFrameworks-UserMode/Operational
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DriverFrameworks-UserMode/Operational
    3⤵
    PID:2132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DucUpdateAgent/Operational
  2⤵
  PID:2052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DucUpdateAgent/Operational
    3⤵
    PID:100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dwm-API/Diagnostic
  2⤵
  PID:3712
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dwm-API/Diagnostic
    3⤵
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dwm-Core/Diagnostic
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dwm-Core/Diagnostic
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dwm-Dwm/Diagnostic
  2⤵
  PID:2580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dwm-Dwm/Diagnostic
    3⤵
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dwm-Redir/Diagnostic
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dwm-Redir/Diagnostic
    3⤵
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Dwm-Udwm/Diagnostic
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Dwm-Udwm/Diagnostic
    3⤵
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxgKrnl-Admin
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxgKrnl-Admin
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxgKrnl-Operational
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxgKrnl-Operational
    3⤵
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxgKrnl/Contention
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxgKrnl/Contention
    3⤵
    PID:524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxgKrnl/Diagnostic
  2⤵
  PID:472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxgKrnl/Diagnostic
    3⤵
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxgKrnl/Performance
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxgKrnl/Performance
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxgKrnl/Power
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxgKrnl/Power
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-DxpTaskSyncProvider/Analytic
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-DxpTaskSyncProvider/Analytic
    3⤵
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EDP-Application-Learning/Admin
  2⤵
  PID:5036
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EDP-Application-Learning/Admin
    3⤵
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EDP-Audit-Regular/Admin
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EDP-Audit-Regular/Admin
    3⤵
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EDP-Audit-TCB/Admin
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EDP-Audit-TCB/Admin
    3⤵
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EFS/Debug
  2⤵
  PID:212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EFS/Debug
    3⤵
    PID:2164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ESE/IODiagnose
  2⤵
  PID:4472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ESE/IODiagnose
    3⤵
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-ESE/Operational
  2⤵
  PID:5084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-ESE/Operational
    3⤵
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapHost/Analytic
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapHost/Analytic
    3⤵
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapHost/Debug
  2⤵
  PID:3576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapHost/Debug
    3⤵
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapHost/Operational
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapHost/Operational
    3⤵
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapMethods-RasChap/Operational
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapMethods-RasChap/Operational
    3⤵
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapMethods-RasTls/Operational
  2⤵
  PID:456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapMethods-RasTls/Operational
    3⤵
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapMethods-Sim/Operational
  2⤵
  PID:232
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapMethods-Sim/Operational
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EapMethods-Ttls/Operational
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EapMethods-Ttls/Operational
    3⤵
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EaseOfAccess/Diagnostic
  2⤵
  PID:1300
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EaseOfAccess/Diagnostic
    3⤵
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Energy-Estimation-Engine/EventLog
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Energy-Estimation-Engine/EventLog
    3⤵
    - Clears Windows event logs
    PID:1296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Energy-Estimation-Engine/Trace
  2⤵
  PID:1292
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Energy-Estimation-Engine/Trace
    3⤵
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic
    3⤵
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EventCollector/Debug
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EventCollector/Debug
    3⤵
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EventCollector/Operational
  2⤵
  PID:2820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EventCollector/Operational
    3⤵
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EventLog-WMIProvider/Debug
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EventLog-WMIProvider/Debug
    3⤵
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EventLog/Analytic
  2⤵
  PID:3024
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EventLog/Analytic
    3⤵
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-EventLog/Debug
  2⤵
  PID:764
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-EventLog/Debug
    3⤵
    PID:208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FMS/Analytic
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FMS/Analytic
    3⤵
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FMS/Debug
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FMS/Debug
    3⤵
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FMS/Operational
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FMS/Operational
    3⤵
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FailoverClustering-Client/Diagnostic
  2⤵
  PID:792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FailoverClustering-Client/Diagnostic
    3⤵
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Fault-Tolerant-Heap/Operational
  2⤵
  PID:3620
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Fault-Tolerant-Heap/Operational
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FeatureConfiguration/Analytic
  2⤵
  PID:2164
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FeatureConfiguration/Analytic
    3⤵
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FeatureConfiguration/Operational
  2⤵
  PID:444
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FeatureConfiguration/Operational
    3⤵
    PID:5112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Catalog/Analytic
  2⤵
  PID:412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Catalog/Analytic
    3⤵
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Catalog/Debug
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Catalog/Debug
    3⤵
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-ConfigManager/Analytic
  2⤵
  PID:4268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-ConfigManager/Analytic
    3⤵
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-ConfigManager/Debug
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-ConfigManager/Debug
    3⤵
    - Clears Windows event logs
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Core/Analytic
  2⤵
  PID:4008
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Core/Analytic
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Core/Debug
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Core/Debug
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Core/WHC
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Core/WHC
    3⤵
    PID:708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Engine/Analytic
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Engine/Analytic
    3⤵
    - Clears Windows event logs
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Engine/BackupLog
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Engine/BackupLog
    3⤵
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Engine/Debug
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Engine/Debug
    3⤵
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-EventListener/Analytic
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-EventListener/Analytic
    3⤵
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-EventListener/Debug
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-EventListener/Debug
    3⤵
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Service/Analytic
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Service/Analytic
    3⤵
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-Service/Debug
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-Service/Debug
    3⤵
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-UI-Events/Analytic
  2⤵
  PID:4272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-UI-Events/Analytic
    3⤵
    PID:3776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileHistory-UI-Events/Debug
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileHistory-UI-Events/Debug
    3⤵
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-FileInfoMinifilter/Operational
  2⤵
  PID:2640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-FileInfoMinifilter/Operational
    3⤵
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Firewall-CPL/Diagnostic
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Firewall-CPL/Diagnostic
    3⤵
    PID:4648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Folder Redirection/Operational
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Folder Redirection/Operational
    3⤵
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Forwarding/Debug
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Forwarding/Debug
    3⤵
    PID:32
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Forwarding/Operational
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Forwarding/Operational
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-GPIO-ClassExtension/Analytic
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-GPIO-ClassExtension/Analytic
    3⤵
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-GenericRoaming/Admin
  2⤵
  PID:4200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-GenericRoaming/Admin
    3⤵
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-GroupPolicy/Operational
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-GroupPolicy/Operational
    3⤵
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HAL/Debug
  2⤵
  PID:3656
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HAL/Debug
    3⤵
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HealthCenter/Debug
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HealthCenter/Debug
    3⤵
    PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HealthCenter/Performance
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HealthCenter/Performance
    3⤵
    - Clears Windows event logs
    PID:4028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HealthCenterCPL/Performance
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HealthCenterCPL/Performance
    3⤵
    PID:1276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HelloForBusiness/Operational
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HelloForBusiness/Operational
    3⤵
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Help/Operational
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Help/Operational
    3⤵
    PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic
  2⤵
  PID:3880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HomeGroup Control Panel/Operational
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HomeGroup Control Panel/Operational
    3⤵
    PID:548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HomeGroup Listener Service/Operational
  2⤵
  PID:1324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HomeGroup Listener Service/Operational
    3⤵
    PID:1500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic
  2⤵
  PID:1176
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic
    3⤵
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HomeGroup Provider Service/Operational
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HomeGroup Provider Service/Operational
    3⤵
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HomeGroup-ListenerService
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HomeGroup-ListenerService
    3⤵
    PID:3400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HotspotAuth/Analytic
  2⤵
  PID:524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HotspotAuth/Analytic
    3⤵
    - Clears Windows event logs
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HotspotAuth/Operational
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HotspotAuth/Operational
    3⤵
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HttpService/Log
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HttpService/Log
    3⤵
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-HttpService/Trace
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-HttpService/Trace
    3⤵
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
    3⤵
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
  2⤵
  PID:1116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
    3⤵
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
  2⤵
  PID:3392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
  2⤵
  PID:3220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
    3⤵
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
  2⤵
  PID:856
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
    3⤵
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Hypervisor-Admin
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Hypervisor-Admin
    3⤵
    PID:3984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Hypervisor-Analytic
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Hypervisor-Analytic
    3⤵
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-Hypervisor-Operational
  2⤵
  PID:3460
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-Hypervisor-Operational
    3⤵
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-VID-Admin
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-VID-Admin
    3⤵
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Hyper-V-VID-Analytic
  2⤵
  PID:2188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Hyper-V-VID-Analytic
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IE-SmartScreen
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IE-SmartScreen
    3⤵
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IKE/Operational
  2⤵
  PID:1984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IKE/Operational
    3⤵
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IKEDBG/Debug
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IKEDBG/Debug
    3⤵
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-Broker/Analytic
  2⤵
  PID:2208
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-Broker/Analytic
    3⤵
    - Clears Windows event logs
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-CandidateUI/Analytic
  2⤵
  PID:1296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-CandidateUI/Analytic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-CustomerFeedbackManager/Debug
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-CustomerFeedbackManager/Debug
    3⤵
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic
  2⤵
  PID:2936
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic
    3⤵
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-JPAPI/Analytic
  2⤵
  PID:344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-JPAPI/Analytic
    3⤵
    - Clears Windows event logs
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-JPLMP/Analytic
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-JPLMP/Analytic
    3⤵
    PID:1124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-JPPRED/Analytic
  2⤵
  PID:1848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-JPPRED/Analytic
    3⤵
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-JPSetting/Analytic
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-JPSetting/Analytic
    3⤵
    - Clears Windows event logs
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-JPTIP/Analytic
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-JPTIP/Analytic
    3⤵
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-KRAPI/Analytic
  2⤵
  PID:2916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-KRAPI/Analytic
    3⤵
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-KRTIP/Analytic
  2⤵
  PID:2256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-KRTIP/Analytic
    3⤵
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-OEDCompiler/Analytic
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-OEDCompiler/Analytic
    3⤵
    PID:1072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-TCCORE/Analytic
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-TCCORE/Analytic
    3⤵
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-TCTIP/Analytic
  2⤵
  PID:3892
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-TCTIP/Analytic
    3⤵
    PID:32
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IME-TIP/Analytic
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IME-TIP/Analytic
    3⤵
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IPNAT/Diagnostic
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IPNAT/Diagnostic
    3⤵
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IPSEC-SRV/Diagnostic
  2⤵
  PID:1408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IPSEC-SRV/Diagnostic
    3⤵
    - Clears Windows event logs
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IPxlatCfg/Debug
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IPxlatCfg/Debug
    3⤵
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IPxlatCfg/Operational
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IPxlatCfg/Operational
    3⤵
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IdCtrls/Analytic
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IdCtrls/Analytic
    3⤵
    - System Location Discovery: System Language Discovery
    PID:676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IdCtrls/Operational
  2⤵
  PID:1368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IdCtrls/Operational
    3⤵
    PID:3076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic
    3⤵
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Input-HIDCLASS-Analytic
  2⤵
  PID:456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Input-HIDCLASS-Analytic
    3⤵
    - Clears Windows event logs
    PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-InputSwitch/Diagnostic
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-InputSwitch/Diagnostic
    3⤵
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
    3⤵
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Iphlpsvc/Debug
  2⤵
  PID:244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Iphlpsvc/Debug
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Iphlpsvc/Operational
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Iphlpsvc/Operational
    3⤵
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-Iphlpsvc/Trace
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl Microsoft-Windows-Iphlpsvc/Trace
    3⤵
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c wevtutil.exe cl Microsoft-Windows-KdsSvc/Operational
  2⤵
  PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Agilis\ImageCleanupTool.log

Filesize
1KB

MD5
be9d1343fba03f161c665b7aedd9cb4c

SHA1
73baa42da8d8460445d0af492a056c955701c17b

SHA256
a79b142e8ba0bf22a7a2888204bd944385ba0f761e339fb67ec4bb87418c7ea2

SHA512
1b261013a11273c6e13533cb62eeb8ec0abbac033f6d205ddc41d1b675a1dd955e02936ce031fb2698de707f9525e0e1f5af69d1deafbe190cb496974dc4a4e8

Download Submit
C:\Agilis\ImageCleanupTool.log

Filesize
4KB

MD5
af7efddb6e3e41b90ba42f9643f16915

SHA1
b0f1f15fb751a466fd815bb3fce4c372b6dcd102

SHA256
cb7a52c4c212a9f722e353e81cd35caa8cb47e37e25bc6e902af5817c3a091b6

SHA512
48e9b35d1f4e042de2d0dd77b89fd58bb1dc510ef6978a7a9d16a4a8a310c670b1891c23506190ff5f23af37512096693d54ed1c2a332a6ea7f7665ab1193885

Download Submit
C:\Agilis\ImageCleanupTool.log

Filesize
619B

MD5
e85253699999bec282fcda4bc2df0243

SHA1
cbf431d65596144341311927e13715b78f42c72d

SHA256
bc0a9b631f5c6a052e94a4df202e61c06410b03c5d91cc316322185ce7341880

SHA512
f3f46f0be7459516829a0b150f91a98021a3e94b14073f6bf13ef7cb9cd8fb64b3ef2f501dd5aa3aa4e485c885de35879873c2f4a149eb5c76dbc70bb606c1bc

Download Submit
C:\Windows\System32\LogFiles\setupcln\diagerr.xml

Filesize
9KB

MD5
b355d70e0ef45ad2e5a9e763e6ac83cb

SHA1
493689aa3f36f6cc433f0a4a73bf1abf58fb7895

SHA256
21ee544e25e2588783c44abb3f3293d044f9b0d6294aac7a6c93c8955f54bc0d

SHA512
339c67805a9a29ec781dffce2c09fa844eca080eb36a28205af39ccb9de6d731f128547c83a5d08fae61a63311ef673c113da3d04e3b071f52c03a8c53c6f7c7

Download Submit
C:\Windows\System32\LogFiles\setupcln\diagwrn.xml

Filesize
9KB

MD5
ef82b304067edcf3cf990a42de93b695

SHA1
a2a2af4015e81562bab4454232bbcb69708f5cd9

SHA256
63a505045b1d4549428a469bf00b0f83aaf58cfd9eb2c32b24f17336e323ab31

SHA512
8f5e17ed20bd033370220c7dc9f1373cd9aa79d3fe3b73cef1dbf0134f8705997f1287427c03d87e16a5932855a553501988b3c43b4ca2329d4d8f153dbe5d41

Download Submit
C:\Windows\System32\LogFiles\setupcln\setupact.log

Filesize
10KB

MD5
60ebe5da79ae5d8741589f91a73c70c1

SHA1
966524c0324f8f4190f017849ee66386c5759427

SHA256
711a59b703bc56664263274fc39a865fd37922639efeb676f7e1bbbb423a72d8

SHA512
a3869ad4003df1ab778cd5a515306668ab34403dd563df936dc5746c4034700b8cce54836100bef502305c2e16331705085b634813d856144fac3680a314da89

Download Submit
C:\Windows\System32\LogFiles\setupcln\setuperr.log

Filesize
1009B

MD5
10d13254388097e1c3a73500a4ecd974

SHA1
6053c9b2cba04082e92ef779916f182ac32e6c8a

SHA256
6b092e7e9fdf9f825aaeb6f8f6105245c91e61a2c1f12a859ef77a9e191a861f

SHA512
1e2e51b0d98782e1161f773f5c57a316bdd1a1cd91403f5b28fdb6b8d4147b32eedcc90bda4a1f32d42ee0619be08deecdc169af0cefc1ddcec270f12860d161

Download Submit
memory/4548-28-0x0000000005650000-0x0000000005672000-memory.dmp

Filesize
136KB

Download
memory/4548-120-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download
memory/4548-1-0x0000000000D10000-0x0000000000D24000-memory.dmp

Filesize
80KB

Download
memory/4548-0-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download
memory/4548-519-0x0000000005EB0000-0x0000000006454000-memory.dmp

Filesize
5.6MB

Download
memory/4548-520-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download