0d04aa56dc4d408adec27419813e9ab81841a0df73fc8a27844eb930ca7b7d19

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VerdacryptorV5.ps1
Size

34KB
MD5

264c23138c8fa42c5349b813eaceadef
SHA1

9b6775c974c762e3623e5a4d6a5889abb4c5483d
SHA256

0d04aa56dc4d408adec27419813e9ab81841a0df73fc8a27844eb930ca7b7d19
SHA512

4738506caa97ca0b07fc929abef76d8f1e9ef13139701101985457763a7cc5d13536f336879f2cab966618f55aa451768be646e04a98876a0ea2d8476384dbb6
SSDEEP

384:thz/s2UBSzj5mMEEpi0D04eEMls/11AUfoUHaWPw3+4CFYw5jIyJyXY:EM5mME00xEbrl6Yq+409IrXY

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000f00000002420c-104.dat	disable_win_def
behavioral2/files/0x0001000000000cd9-268.dat	disable_win_def

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AlertAleph-lCJxeGTW.ps1\" -HiddenRun"	powershell.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5664	2088	Process not Found	1259

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5448	Process not Found
5808	Process not Found
5904	Process not Found
1724	wevtutil.exe
2100	wevtutil.exe
3472	Process not Found
5604	Process not Found
7932	Process not Found
1672	wevtutil.exe
2832	wevtutil.exe
4400	Process not Found
4860	Process not Found
5528	Process not Found
2796	Process not Found
4528	Process not Found
452	Process not Found
3796	Process not Found
5880	Process not Found
5352	Process not Found
6168	Process not Found
5972	Process not Found
4644	Process not Found
5908	Process not Found
5680	Process not Found
812	Process not Found
3132	Process not Found
4588	wevtutil.exe
4948	Process not Found
1852	Process not Found
5552	Process not Found
3132	Process not Found
6804	Process not Found
6680	Process not Found
4404	wevtutil.exe
3208	Process not Found
4036	Process not Found
5912	Process not Found
2936	Process not Found
5576	Process not Found
3848	wevtutil.exe
2388	Process not Found
5852	Process not Found
2672	Process not Found
5940	Process not Found
6432	Process not Found
6328	Process not Found
2764	Process not Found
5500	Process not Found
6576	Process not Found
372	Process not Found
2388	Process not Found
756	Process not Found
5500	Process not Found
6124	Process not Found
3832	Process not Found
6032	Process not Found
3724	Process not Found
2644	Process not Found
1852	Process not Found
1156	Process not Found
452	Process not Found
5352	Process not Found
5956	Process not Found
2140	wevtutil.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 56 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2020	Process not Found
5660	Process not Found
6040	Process not Found
7860	Process not Found
6712	Process not Found
740	Process not Found
3724	Process not Found
5672	Process not Found
7004	Process not Found
6484	Process not Found
7540	Process not Found
5840	Process not Found
3708	Process not Found
5664	Process not Found
7312	Process not Found
5460	Process not Found
4520	Process not Found
5352	Process not Found
548	Process not Found
5860	Process not Found
3684	Process not Found
3680	Process not Found
4836	Process not Found
5952	Process not Found
6328	Process not Found
7468	Process not Found
7740	Process not Found
7904	Process not Found
5372	Process not Found
5484	Process not Found
5932	Process not Found
7852	Process not Found
7480	Process not Found
2752	Process not Found
4956	Process not Found
5124	Process not Found
6780	Process not Found
2840	Process not Found
3464	Process not Found
1092	Process not Found
756	Process not Found
7396	Process not Found
7872	Process not Found
4056	Process not Found
1436	Process not Found
2776	Process not Found
5876	Process not Found
6512	Process not Found
6428	Process not Found
7032	Process not Found
7072	Process not Found
6420	Process not Found
464	powershell.exe
5816	Process not Found
5904	Process not Found
1612	Process not Found

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "powershell -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\VerdacryptorV5.ps1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsEnhancer = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AlertAleph-lCJxeGTW.ps1\" -HiddenRun"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdateCheck = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AlertAleph-lCJxeGTW.ps1\" -HiddenRun"	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 22 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5196	Process not Found
5000	Process not Found
5340	Process not Found
6856	Process not Found
6288	Process not Found
5444	Process not Found
6900	Process not Found
4656	Process not Found
6948	Process not Found
1660	Process not Found
4688	Process not Found
3064	Process not Found
5720	Process not Found
5768	Process not Found
6564	Process not Found
6388	Process not Found
6524	Process not Found
4572	Process not Found
5188	Process not Found
5648	Process not Found
6876	Process not Found
6656	Process not Found

Power Settings 1 TTPs 13 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5584	Process not Found
1996	Process not Found
2780	Process not Found
3800	Process not Found
2512	Process not Found
4240	Process not Found
5636	Process not Found
864	Process not Found
4044	Process not Found
5584	Process not Found
2088	wevtutil.exe
1388	Process not Found
3536	Process not Found

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\AlertAleph-lCJxeGTW.ps1	powershell.exe
File opened for modification	C:\Windows\System32\AlertAleph-lCJxeGTW.ps1	powershell.exe
File opened for modification	C:\Windows\System32\config\systemprofile:Jakatatales.ps1	powershell.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6044	Process not Found
7092	Process not Found
1396	Process not Found
5364	Process not Found
7724	Process not Found
808	Process not Found
5316	Process not Found
4556	Process not Found
5828	Process not Found
6324	Process not Found
4132	Process not Found

System Time Discovery 1 TTPs 13 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3132	Process not Found
1020	wevtutil.exe
4124	Process not Found
2140	Process not Found
4760	Process not Found
3192	Process not Found
5956	Process not Found
2100	Process not Found
3132	Process not Found
5912	Process not Found
2996	Process not Found
5952	Process not Found
3332	Process not Found

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
464	powershell.exe
464	powershell.exe
464	powershell.exe
1436	Process not Found
1436	Process not Found
1436	Process not Found
2752	Process not Found
2752	Process not Found
2752	Process not Found
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
3680	Process not Found
3680	Process not Found
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
3464	Process not Found
3464	Process not Found
3680	Process not Found
3464	Process not Found
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
464	powershell.exe
2020	Process not Found
2020	Process not Found
2020	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	powershell.exe
Token: SeSecurityPrivilege	3644	wevtutil.exe
Token: SeBackupPrivilege	3644	wevtutil.exe
Token: SeSecurityPrivilege	372	wevtutil.exe
Token: SeBackupPrivilege	372	wevtutil.exe
Token: SeSecurityPrivilege	4440	wevtutil.exe
Token: SeBackupPrivilege	4440	wevtutil.exe
Token: SeSecurityPrivilege	4688	wevtutil.exe
Token: SeBackupPrivilege	4688	wevtutil.exe
Token: SeSecurityPrivilege	1428	wevtutil.exe
Token: SeBackupPrivilege	1428	wevtutil.exe
Token: SeSecurityPrivilege	1660	wevtutil.exe
Token: SeBackupPrivilege	1660	wevtutil.exe
Token: SeSecurityPrivilege	4944	wevtutil.exe
Token: SeBackupPrivilege	4944	wevtutil.exe
Token: SeSecurityPrivilege	4028	wevtutil.exe
Token: SeBackupPrivilege	4028	wevtutil.exe
Token: SeSecurityPrivilege	4540	wevtutil.exe
Token: SeBackupPrivilege	4540	wevtutil.exe
Token: SeSecurityPrivilege	4752	wevtutil.exe
Token: SeBackupPrivilege	4752	wevtutil.exe
Token: SeSecurityPrivilege	4212	wevtutil.exe
Token: SeBackupPrivilege	4212	wevtutil.exe
Token: SeSecurityPrivilege	3852	wevtutil.exe
Token: SeBackupPrivilege	3852	wevtutil.exe
Token: SeSecurityPrivilege	3452	wevtutil.exe
Token: SeBackupPrivilege	3452	wevtutil.exe
Token: SeSecurityPrivilege	3832	wevtutil.exe
Token: SeBackupPrivilege	3832	wevtutil.exe
Token: SeSecurityPrivilege	1456	wevtutil.exe
Token: SeBackupPrivilege	1456	wevtutil.exe
Token: SeSecurityPrivilege	704	wevtutil.exe
Token: SeBackupPrivilege	704	wevtutil.exe
Token: SeSecurityPrivilege	2996	wevtutil.exe
Token: SeBackupPrivilege	2996	wevtutil.exe
Token: SeSecurityPrivilege	2140	wevtutil.exe
Token: SeBackupPrivilege	2140	wevtutil.exe
Token: SeSecurityPrivilege	4224	wevtutil.exe
Token: SeBackupPrivilege	4224	wevtutil.exe
Token: SeSecurityPrivilege	3120	wevtutil.exe
Token: SeBackupPrivilege	3120	wevtutil.exe
Token: SeSecurityPrivilege	3492	wevtutil.exe
Token: SeBackupPrivilege	3492	wevtutil.exe
Token: SeSecurityPrivilege	2612	wevtutil.exe
Token: SeBackupPrivilege	2612	wevtutil.exe
Token: SeSecurityPrivilege	3156	wevtutil.exe
Token: SeBackupPrivilege	3156	wevtutil.exe
Token: SeSecurityPrivilege	5100	wevtutil.exe
Token: SeBackupPrivilege	5100	wevtutil.exe
Token: SeSecurityPrivilege	452	wevtutil.exe
Token: SeBackupPrivilege	452	wevtutil.exe
Token: SeSecurityPrivilege	1460	wevtutil.exe
Token: SeBackupPrivilege	1460	wevtutil.exe
Token: SeSecurityPrivilege	1816	wevtutil.exe
Token: SeBackupPrivilege	1816	wevtutil.exe
Token: SeSecurityPrivilege	3660	wevtutil.exe
Token: SeBackupPrivilege	3660	wevtutil.exe
Token: SeSecurityPrivilege	3380	wevtutil.exe
Token: SeBackupPrivilege	3380	wevtutil.exe
Token: SeSecurityPrivilege	536	wevtutil.exe
Token: SeBackupPrivilege	536	wevtutil.exe
Token: SeSecurityPrivilege	4148	wevtutil.exe
Token: SeBackupPrivilege	4148	wevtutil.exe
Token: SeSecurityPrivilege	1928	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 4856	464	powershell.exe	90
PID 464 wrote to memory of 4856	464	powershell.exe	90
PID 4856 wrote to memory of 2456	4856	csc.exe	93
PID 4856 wrote to memory of 2456	4856	csc.exe	93
PID 464 wrote to memory of 4648	464	powershell.exe	96
PID 464 wrote to memory of 4648	464	powershell.exe	96
PID 464 wrote to memory of 3644	464	powershell.exe	98
PID 464 wrote to memory of 3644	464	powershell.exe	98
PID 464 wrote to memory of 372	464	powershell.exe	218
PID 464 wrote to memory of 372	464	powershell.exe	218
PID 464 wrote to memory of 4440	464	powershell.exe	100
PID 464 wrote to memory of 4440	464	powershell.exe	100
PID 464 wrote to memory of 4688	464	powershell.exe	101
PID 464 wrote to memory of 4688	464	powershell.exe	101
PID 464 wrote to memory of 1428	464	powershell.exe	102
PID 464 wrote to memory of 1428	464	powershell.exe	102
PID 464 wrote to memory of 1660	464	powershell.exe	103
PID 464 wrote to memory of 1660	464	powershell.exe	103
PID 464 wrote to memory of 4944	464	powershell.exe	104
PID 464 wrote to memory of 4944	464	powershell.exe	104
PID 464 wrote to memory of 4028	464	powershell.exe	105
PID 464 wrote to memory of 4028	464	powershell.exe	105
PID 464 wrote to memory of 4540	464	powershell.exe	228
PID 464 wrote to memory of 4540	464	powershell.exe	228
PID 464 wrote to memory of 4752	464	powershell.exe	229
PID 464 wrote to memory of 4752	464	powershell.exe	229
PID 464 wrote to memory of 4212	464	powershell.exe	230
PID 464 wrote to memory of 4212	464	powershell.exe	230
PID 464 wrote to memory of 3852	464	powershell.exe	231
PID 464 wrote to memory of 3852	464	powershell.exe	231
PID 464 wrote to memory of 3452	464	powershell.exe	232
PID 464 wrote to memory of 3452	464	powershell.exe	232
PID 464 wrote to memory of 3832	464	powershell.exe	233
PID 464 wrote to memory of 3832	464	powershell.exe	233
PID 464 wrote to memory of 1456	464	powershell.exe	234
PID 464 wrote to memory of 1456	464	powershell.exe	234
PID 464 wrote to memory of 704	464	powershell.exe	113
PID 464 wrote to memory of 704	464	powershell.exe	113
PID 464 wrote to memory of 2996	464	powershell.exe	114
PID 464 wrote to memory of 2996	464	powershell.exe	114
PID 464 wrote to memory of 2140	464	powershell.exe	115
PID 464 wrote to memory of 2140	464	powershell.exe	115
PID 464 wrote to memory of 4224	464	powershell.exe	116
PID 464 wrote to memory of 4224	464	powershell.exe	116
PID 464 wrote to memory of 3120	464	powershell.exe	117
PID 464 wrote to memory of 3120	464	powershell.exe	117
PID 464 wrote to memory of 3492	464	powershell.exe	237
PID 464 wrote to memory of 3492	464	powershell.exe	237
PID 464 wrote to memory of 2612	464	powershell.exe	119
PID 464 wrote to memory of 2612	464	powershell.exe	119
PID 464 wrote to memory of 3156	464	powershell.exe	238
PID 464 wrote to memory of 3156	464	powershell.exe	238
PID 464 wrote to memory of 5100	464	powershell.exe	184
PID 464 wrote to memory of 5100	464	powershell.exe	184
PID 464 wrote to memory of 452	464	powershell.exe	185
PID 464 wrote to memory of 452	464	powershell.exe	185
PID 464 wrote to memory of 1460	464	powershell.exe	186
PID 464 wrote to memory of 1460	464	powershell.exe	186
PID 464 wrote to memory of 1816	464	powershell.exe	125
PID 464 wrote to memory of 1816	464	powershell.exe	125
PID 464 wrote to memory of 3660	464	powershell.exe	126
PID 464 wrote to memory of 3660	464	powershell.exe	126
PID 464 wrote to memory of 3380	464	powershell.exe	127
PID 464 wrote to memory of 3380	464	powershell.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\VerdacryptorV5.ps1
1⤵
- Modifies WinLogon for persistence
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ziigyxrm\ziigyxrm.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78CA.tmp" "c:\Users\Admin\AppData\Local\Temp\ziigyxrm\CSC6E9458CFBCFF406080E5382291FABEC3.TMP"
    3⤵
    PID:2456
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\SomeTask
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" el
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl AMSI/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl AirSpaceChannel
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Application
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl DirectShowFilterGraph
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl DirectShowPluginControl
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Els_Hyphenation/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl EndpointMapper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl FirstUXPerf-Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl ForwardedEvents
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "General Logging"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl HardwareEvents
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl IHM_DebugChannel
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS-GPIO/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS-I2C/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-GPIO2/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-GPIO2/Performance
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-I2C/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-I2C/Performance
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Internet Explorer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Key Management Service"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationDeviceMFT
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationDeviceProxy
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationFrameServer
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MedaFoundationVideoProc
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MedaFoundationVideoProcD3D
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1816
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationAsyncWrapper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationContentProtection
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationDS
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationDeviceProxy
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationMP4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationMediaEngine
  2⤵
  PID:2024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPerformance
  2⤵
  PID:2784
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPerformanceCore
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPipeline
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPlatform
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationSrcPrefetch
  2⤵
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client-Streamingux/Debug
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Admin
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Debug
  2⤵
  PID:4004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Operational
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-AppV-Client/Virtual Applications"
  2⤵
  PID:4452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-SharedPerformance/Analytic
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Admin
  2⤵
  PID:188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Debug
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Diagnostic
  2⤵
  PID:3548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-IE/Diagnostic
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-IEFRAME/Diagnostic
  2⤵
  PID:3748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-JSDumpHeap/Diagnostic
  2⤵
  PID:696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-OneCore-Setup/Analytic
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-PerfTrack-IEFRAME/Diagnostic
  2⤵
  PID:4640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-PerfTrack-MSHTML/Diagnostic
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Admin/Debug"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Debug"
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Operational"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-IPC/Operational"
  2⤵
  PID:3536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
  2⤵
  PID:880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
  2⤵
  PID:3008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Analytic
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Operational
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ADSI/Debug
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ASN1/Operational
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ATAPort/General
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ATAPort/SATA-LPM
  2⤵
  PID:1888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ActionQueue/Analytic
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-All-User-Install-Agent/Admin
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Debug
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Operational
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Admin
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/ApplicationTracing
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Diagnostic
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Internal
  2⤵
  PID:1456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppID/Operational
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/EXE and DLL"
  2⤵
  PID:3532
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/MSI and Script"
  2⤵
  PID:1616
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
  2⤵
  PID:1200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
  2⤵
  PID:1392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Admin
  2⤵
  PID:2308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Analytic
  2⤵
  PID:5100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Debug
  2⤵
  PID:452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Diagnostics
  2⤵
  PID:3464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-State/Debug
  2⤵
  PID:3960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-State/Diagnostic
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Admin
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Debug
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Operational
  2⤵
  PID:3488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppSruProv
  2⤵
  PID:5084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Diagnostic
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Operational
  2⤵
  PID:2416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Debug
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Diagnostic
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Operational
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Restricted
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Analytic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Operational
  2⤵
  PID:2668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Admin"
  2⤵
  PID:2608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Analytic"
  2⤵
  PID:3696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Debug"
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Operational"
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
  2⤵
  PID:3540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic
  2⤵
  PID:1496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace
  2⤵
  PID:1812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
  2⤵
  PID:4104
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Inventory
  2⤵
  PID:1228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Telemetry
  2⤵
  PID:3512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Steps-Recorder
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Debug
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Operational
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Performance
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Admin
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Operational
  2⤵
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Admin
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Operational
  2⤵
  PID:3008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AsynchronousCausality/Causality
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/CaptureMonitor
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/GlitchDetection
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Informational
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Operational
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Performance
  2⤵
  PID:1888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/PlaybackManager
  2⤵
  - Clears Windows event logs
  PID:3848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audit/Analytic
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Authentication User Interface/Operational"
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUser-Client
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AxInstallService/Log
  2⤵
  PID:1456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHPORT/HCI
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHPORT/L2CAP
  2⤵
  PID:3532
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHUSB/Diagnostic
  2⤵
  PID:3492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHUSB/Performance
  2⤵
  PID:3156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic
  2⤵
  PID:2556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Operational
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Backup
  2⤵
  PID:3276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
  2⤵
  PID:3056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Battery/Diagnostic
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Analytic
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Operational
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
  2⤵
  PID:3176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-Driver-Performance/Operational
  2⤵
  - Clears Windows event logs
  PID:1724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Management"
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Operational"
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker/Tracing
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Analytic
  2⤵
  PID:4384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Operational
  2⤵
  PID:4496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Bthmini/Operational
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-MTPEnum/Operational
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Policy/Operational
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCache/Operational
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheEventProvider/Diagnostic
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheMonitoring/Analytic
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Analytic
  2⤵
  PID:3132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Operational
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CAPI2/Operational
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CDROM/Operational
  2⤵
  PID:1780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/Analytic
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ApartmentInitialize
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ApartmentUninitialize
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/Call
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/CreateInstance
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ExtensionCatalog
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/FreeUnusedLibrary
  2⤵
  PID:3536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/RundownInstrumentation
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/Activations
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/MessageProcessing
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/Tracing
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertPoleEng/Operational
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
  2⤵
  PID:5104
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Cleanmgr/Diagnostic
  2⤵
  PID:4204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ClearTypeTextTuner/Diagnostic
  2⤵
  PID:1624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Debug
  2⤵
  PID:3796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Operational
  2⤵
  PID:2204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CmiSetup/Analytic
  2⤵
  PID:392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Operational
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Verbose
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ComDlg32/Analytic
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ComDlg32/Debug
  2⤵
  PID:4900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Analytic
  2⤵
  - Clears Windows event logs
  PID:2140
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Operational
  2⤵
  PID:1392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Debug
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Operational
  2⤵
  PID:5020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Debug
  2⤵
  PID:456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Operational
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Debug
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Operational
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Diagnostic
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Operational
  2⤵
  PID:5084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Tracing
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug
  2⤵
  PID:4388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational
  2⤵
  PID:2356
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreWindow/Analytic
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreWindow/Debug
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Client/Operational
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Server/Operational
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crashdump/Operational
  2⤵
  PID:1044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CredUI/Diagnostic
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-BCRYPT/Analytic
  2⤵
  PID:2488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-CNG/Analytic
  2⤵
  PID:3612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
  2⤵
  PID:3060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Debug
  2⤵
  PID:3548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Operational
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DSSEnh/Analytic
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-NCrypt/Operational
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-RNG/Analytic
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-RSAEnh/Analytic
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-D3D10Level9/Analytic
  2⤵
  PID:3132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-D3D10Level9/PerfTiming
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Analytic
  2⤵
  PID:4640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Operational
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAMM/Diagnostic
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DCLocator/Debug
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DDisplay/Analytic
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DDisplay/Logging
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DLNA-Namespace/Analytic
  2⤵
  PID:4908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DNS-Client/Operational
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Admin
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Analytic
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Debug
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Operational
  2⤵
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DUI/Diagnostic
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DUSER/Diagnostic
  2⤵
  PID:3552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXGI/Analytic
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXGI/Logging
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXP/Analytic
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Data-Pdf/Debug
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/Admin
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/CrashRecovery
  2⤵
  PID:3724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Analytic
  2⤵
  PID:3868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Debug
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Operational
  2⤵
  PID:4580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Diagnostic
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Operational
  2⤵
  PID:4028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Performance
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Scrubbing
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Defrag-Core/Debug
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deplorch/Analytic
  2⤵
  PID:2260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DesktopActivityModerator/Diagnostic
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceAssociationService/Performance
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceConfidence/Analytic
  2⤵
  PID:872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Operational
  2⤵
  PID:704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Verbose
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug
  2⤵
  PID:456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Admin
  2⤵
  PID:3056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Analytic
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Debug
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Operational
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Analytic
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Operational
  2⤵
  PID:2416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUpdateAgent/Operational
  2⤵
  PID:1988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUx/Informational
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUx/Performance
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Devices-Background/Operational
  2⤵
  PID:4384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Admin
  2⤵
  PID:4496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Operational
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Admin
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Operational
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiagCpl/Debug
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Analytic
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Debug
  2⤵
  PID:3748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Operational
  2⤵
  PID:3972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-MSDE/Debug
  2⤵
  PID:696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Analytic
  2⤵
  PID:3064
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Debug
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Operational
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Debug
  2⤵
  PID:916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Operational
  2⤵
  PID:3512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Perfhost/Analytic
  2⤵
  PID:1852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scheduled/Operational
  2⤵
  PID:4696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Admin
  2⤵
  PID:1088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Analytic
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Debug
  2⤵
  PID:4908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Operational
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
  2⤵
  PID:4440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-WDC/Analytic
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-WDI/Debug
  2⤵
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Debug
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Operational
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic
  2⤵
  PID:3404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Diagnostic
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Operational
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D10/Analytic
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D10_1/Analytic
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/Analytic
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/Logging
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/PerfTiming
  2⤵
  - Clears Windows event logs
  PID:1672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/Analytic
  2⤵
  PID:3756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/Logging
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/PerfTiming
  2⤵
  PID:852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D9/Analytic
  2⤵
  PID:2712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3DShaderCache/Default
  2⤵
  PID:3796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectComposition/Diagnostic
  2⤵
  PID:2204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectManipulation/Diagnostic
  2⤵
  PID:392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectShow-KernelSupport/Performance
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectSound/Debug
  2⤵
  PID:380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Disk/Operational
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnostic/Operational
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticDataCollector/Operational
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticResolver/Operational
  2⤵
  PID:3276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/Analytic
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/ExternalAnalytic
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/InternalAnalytic
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Cli/Analytic
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Debug
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Operational
  2⤵
  PID:1544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplaySwitch/Diagnostic
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Documents/Performance
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dot3MM/Diagnostic
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DriverFrameworks-UserMode/Operational
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DucUpdateAgent/Operational
  2⤵
  PID:1044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-API/Diagnostic
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Core/Diagnostic
  2⤵
  PID:2488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Dwm/Diagnostic
  2⤵
  PID:3612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Redir/Diagnostic
  2⤵
  PID:3060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Udwm/Diagnostic
  2⤵
  PID:3548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Admin
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Operational
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Contention
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Diagnostic
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Performance
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Power
  2⤵
  PID:3132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxpTaskSyncProvider/Analytic
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Application-Learning/Admin
  2⤵
  PID:4640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-Regular/Admin
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-TCB/Admin
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EFS/Debug
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/IODiagnose
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/Operational
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Analytic
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Debug
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Operational
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasChap/Operational
  2⤵
  PID:880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasTls/Operational
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Sim/Operational
  2⤵
  PID:2876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Ttls/Operational
  2⤵
  PID:4032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EaseOfAccess/Diagnostic
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/EventLog
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/Trace
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic
  2⤵
  PID:3536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Debug
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Operational
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog-WMIProvider/Debug
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog/Analytic
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog/Debug
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Analytic
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Debug
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Operational
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FailoverClustering-Client/Diagnostic
  2⤵
  PID:1672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Fault-Tolerant-Heap/Operational
  2⤵
  PID:3756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Analytic
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Operational
  2⤵
  PID:852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Catalog/Analytic
  2⤵
  PID:2712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Catalog/Debug
  2⤵
  PID:3796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-ConfigManager/Analytic
  2⤵
  PID:2204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-ConfigManager/Debug
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/Analytic
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/Debug
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/WHC
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/Analytic
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/BackupLog
  2⤵
  PID:456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/Debug
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-EventListener/Analytic
  2⤵
  PID:3056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-EventListener/Debug
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Service/Analytic
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Service/Debug
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-UI-Events/Analytic
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-UI-Events/Debug
  2⤵
  PID:2416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileInfoMinifilter/Operational
  2⤵
  PID:1988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Firewall-CPL/Diagnostic
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Folder Redirection/Operational"
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Debug
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Operational
  2⤵
  PID:1044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GPIO-ClassExtension/Analytic
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GenericRoaming/Admin
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GroupPolicy/Operational
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HAL/Debug
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenter/Debug
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenter/Performance
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenterCPL/Performance
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HelloForBusiness/Operational
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Help/Operational
  2⤵
  PID:1132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
  2⤵
  PID:3132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
  2⤵
  PID:4640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HomeGroup-ListenerService
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Analytic
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Operational
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Log
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Trace
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
  2⤵
  PID:880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
  2⤵
  PID:2876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
  2⤵
  PID:4032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Admin
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Analytic
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Operational
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
  2⤵
  PID:3536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Admin
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Analytic
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IE-SmartScreen
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKE/Operational
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKEDBG/Debug
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-Broker/Analytic
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CandidateUI/Analytic
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CustomerFeedbackManager/Debug
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPAPI/Analytic
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPLMP/Analytic
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPPRED/Analytic
  2⤵
  PID:1624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPSetting/Analytic
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPTIP/Analytic
  2⤵
  PID:1472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-KRAPI/Analytic
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-KRTIP/Analytic
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-OEDCompiler/Analytic
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TCCORE/Analytic
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TCTIP/Analytic
  2⤵
  PID:3472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TIP/Analytic
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPNAT/Diagnostic
  2⤵
  PID:2780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPSEC-SRV/Diagnostic
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Debug
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Operational
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Analytic
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Operational
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Input-HIDCLASS-Analytic
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-InputSwitch/Diagnostic
  2⤵
  PID:5084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Debug
  2⤵
  PID:4388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Operational
  2⤵
  PID:2356
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Trace
  2⤵
  PID:3984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KdsSvc/Operational
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kerberos/Operational
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Acpi/Diagnostic
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-AppCompat/General
  2⤵
  PID:1044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-AppCompat/Performance
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Analytic
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Debug
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Operational
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Analytic
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Operational
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Disk/Analytic
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Admin
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Analytic
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-File/Analytic
  2⤵
  PID:4104
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IO/Operational
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IoTrace/Diagnostic
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Analytic
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Operational
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Memory/Analytic
  2⤵
  PID:3708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Network/Analytic
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Pdc/Diagnostic
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Pep/Diagnostic
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
  2⤵
  PID:2100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-PnP/Configuration
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Diagnostic
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Operational
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Prefetch/Diagnostic
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Process/Analytic
  2⤵
  PID:3028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Processor-Power/Diagnostic
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Registry/Analytic
  2⤵
  PID:4924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Registry/Performance
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Debug
  2⤵
  PID:1888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Diagnostic
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Operational
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Analytic
  2⤵
  PID:1276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Operational
  2⤵
  PID:3764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Analytic
  2⤵
  PID:1904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Debug
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Operational
  2⤵
  PID:392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Errors
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Operational
  2⤵
  PID:408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-XDV/Analytic
  2⤵
  PID:548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Admin
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Operational
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Performance
  2⤵
  PID:380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Known Folders API Service"
  2⤵
  PID:1456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-L2NA/Diagnostic
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LDAP-Client/Debug
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Diagnostic
  2⤵
  PID:3276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Operational
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Performance
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LUA-ConsentUI/Diagnostic
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Analytic
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Debug
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Operational
  2⤵
  PID:3176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LimitsManagement/Diagnostic
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Analytic
  2⤵
  PID:4452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Operational
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-CLNT/Diagnostic
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-DRV/Diagnostic
  2⤵
  PID:1044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-SRV/Diagnostic
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSFTEDIT/Diagnostic
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Admin
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Debug
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Diagnostic
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Admin
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Analytic
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Debug
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Operational
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/DMC
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/DMR
  2⤵
  PID:4104
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/MDE
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/Transform
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-Performance/SARStreamResource
  2⤵
  PID:3708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-PlayAPI/Analytic
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MemoryDiagnostics-Results/Debug
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Minstore/Analytic
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Minstore/Debug
  2⤵
  - Clears Windows event logs
  PID:2100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MobilityCenter/Performance
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mprddm/Operational
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Analytic
  2⤵
  PID:4924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Operational
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDF-HelperClassDiscovery/Debug
  2⤵
  PID:1888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS-PacketCapture/Diagnostic
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Diagnostic
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Operational
  2⤵
  PID:1276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NTLM/Operational
  2⤵
  PID:3764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NWiFi/Diagnostic
  2⤵
  PID:1904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Narrator/Diagnostic
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ncasvc/Operational
  2⤵
  PID:392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Diagnostic
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Operational
  2⤵
  PID:408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NdisImPlatform/Operational
  2⤵
  PID:2512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ndu/Diagnostic
  2⤵
  PID:3680
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetShell/Performance
  2⤵
  PID:4060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-Connection-Broker
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-DataUsage/Analytic
  2⤵
  PID:2780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-Setup/Diagnostic
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-and-Sharing-Center/Diagnostic
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkBridge/Diagnostic
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkLocationWizard/Operational
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Diagnostic
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Operational
  2⤵
  PID:3056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvider/Operational
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Analytic
  2⤵
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Operational
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkSecurity/Debug
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkStatus/Analytic
  2⤵
  PID:2416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Networking-Correlation/Diagnostic
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Networking-RealTimeCommunication/Tracing
  2⤵
  - System Time Discovery
  PID:1020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Diagnostic
  2⤵
  PID:4384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Operational
  2⤵
  PID:4496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Operational
  2⤵
  PID:2668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Performance
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/WHC
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLE/Clipboard-Performance
  2⤵
  PID:3696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLEACC/Debug
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLEACC/Diagnostic
  2⤵
  PID:2036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic
  2⤵
  PID:3972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-Core/Diagnostic
  2⤵
  PID:1096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Diagnostic
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Operational
  2⤵
  PID:1132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OcpUpdateAgent/Operational
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Analytic
  2⤵
  PID:1228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Debug
  2⤵
  PID:1780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Operational
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/SyncLog
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneBackup/Debug
  2⤵
  PID:1088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Diagnostic
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Operational
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OobeLdr/Analytic
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OtpCredentialProvider/Operational
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PCI/Diagnostic
  2⤵
  PID:880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Analytic
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Debug
  2⤵
  PID:2876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Operational
  2⤵
  PID:2400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ParentalControls/Operational
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Analytic
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Diagnostic
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionRuntime/Operational
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionSensorDataService/Operational
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Analytic
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Operational
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Analytic
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Operational
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Analytic
  2⤵
  PID:1672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Certification
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Diagnose
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Operational
  2⤵
  PID:1624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PhotoAcq/Analytic
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PlayToManager/Analytic
  2⤵
  PID:1472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Analytic
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Operational
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PortableDeviceStatusProvider/Analytic
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PortableDeviceSyncProvider/Analytic
  2⤵
  PID:548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Power-Meter-Polling/Diagnostic
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerCfg/Diagnostic
  2⤵
  - Power Settings
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerCpl/Diagnostic
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic
  2⤵
  PID:872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic
  2⤵
  PID:704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Admin
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Analytic
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Debug
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrimaryNetworkIcon/Performance
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintBRM/Admin
  2⤵
  PID:3176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService-USBMon/Debug
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Admin
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Debug
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Operational
  2⤵
  PID:4452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Privacy-Auditing/Operational
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ProcessStateManager/Diagnostic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/Analytic
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade
  2⤵
  PID:3612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot
  2⤵
  PID:3420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug
  2⤵
  PID:700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Diagnostic
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Informational
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Performance
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Developer/Debug
  2⤵
  PID:1812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-InProc/Debug
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Admin
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Debug
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Operational
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-QoS-Pacer/Diagnostic
  2⤵
  PID:1156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-QoS-qWAVE/Debug
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC-Proxy/Debug
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC/Debug
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC/EEInfo
  2⤵
  PID:1308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Debug
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Operational
  2⤵
  PID:4440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RadioManager/Analytic
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic
  2⤵
  PID:2100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Debug
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Operational
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReFS/Operational
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Analytic
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Operational
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Analytic
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Operational
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Regsvr32/Operational
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
  2⤵
  PID:3028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Admin
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Operational
  2⤵
  PID:4924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Tracing
  2⤵
  PID:4028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin
  2⤵
  PID:1888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin
  2⤵
  PID:808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug
  2⤵
  PID:3764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational
  2⤵
  PID:1472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Diagnostic
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Operational
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ResetEng-Trace/Diagnostic
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Detector/Operational
  2⤵
  PID:548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ResourcePublication/Tracing
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RestartManager/Operational
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Admin
  2⤵
  PID:872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Operational
  2⤵
  PID:704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Graphics/Analytic
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Networking/Tracing
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Web-Http/Tracing
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-WebAPI/Tracing
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource
  2⤵
  PID:3176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime/CreateInstance
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime/Error
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Analytic
  2⤵
  PID:4452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/HelperClassDiagnostic
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/ObjectStateDiagnostic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Operational
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Admin
  2⤵
  PID:3612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Debug
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Netmon
  2⤵
  PID:3420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Analytic
  2⤵
  PID:700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Audit
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Connectivity
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Diagnostic
  2⤵
  PID:1068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Operational
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Performance
  2⤵
  PID:1812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Security
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Admin
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Informational
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SPB-ClassExtension/Analytic
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SPB-HIDI2C/Analytic
  2⤵
  PID:1156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Schannel-Events/Perf
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdbus/Analytic
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdbus/Debug
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdstor/Analytic
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Search-Core/Diagnostic
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Search-ProtocolHandlers/Diagnostic
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Diagnostic
  2⤵
  PID:880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Operational
  2⤵
  - Clears Windows event logs
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecureAssessment/Operational
  2⤵
  PID:4952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Adminless/Operational
  2⤵
  PID:2400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Operational
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityListener/Operational
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityStore/Performance
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/KernelMode
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/UserMode
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Netlogon/Operational
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GC/Analytic
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational
  2⤵
  PID:1672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX/Analytic
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP/Perf
  2⤵
  PID:1624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-UserConsentVerifier/Audit
  2⤵
  PID:2204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Vault/Performance
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Admin
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Operational
  2⤵
  PID:408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Perf
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SendTo/Diagnostic
  2⤵
  PID:3680
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sens/Debug
  2⤵
  PID:3816
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sensors/Debug
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sensors/Performance
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Serial-ClassExtension-V2/Analytic
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Serial-ClassExtension/Analytic
  2⤵
  PID:3276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ServiceReportingApi/Debug
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Services-Svchost/Diagnostic
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Services/Diagnostic
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Servicing/Debug
  2⤵
  PID:3488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Debug
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Operational
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Analytic
  2⤵
  PID:2356
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Debug
  2⤵
  PID:1544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Operational
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Analytic
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Debug
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Operational
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/VerboseDebug
  2⤵
  PID:2608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Setup/Analytic
  2⤵
  PID:2668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupCl/Analytic
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupPlatform/Analytic
  2⤵
  PID:4572
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupQueue/Analytic
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupUGC/Analytic
  2⤵
  PID:4072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic
  2⤵
  PID:696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AppWizCpl/Diagnostic
  2⤵
  PID:3972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Common/Diagnostic
  2⤵
  PID:4380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic
  2⤵
  PID:1228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic
  2⤵
  PID:1780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/ActionCenter
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/AppDefaults
  2⤵
  PID:4908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Diagnostic
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/LogonTasksChannel
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Operational
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-DefaultPrograms/Diagnostic
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-LockScreenContent/Diagnostic
  2⤵
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-OpenWith/Diagnostic
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Shwebsvc
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ZipFolder/Diagnostic
  2⤵
  PID:3404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shsvcs/Diagnostic
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SleepStudy/Diagnostic
  2⤵
  PID:4240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-Audit/Authentication
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-DeviceEnum/Operational
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational
  2⤵
  PID:3460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartScreen/Debug
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Audit
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Connectivity
  2⤵
  PID:5104
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Diagnostic
  2⤵
  PID:3756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Security
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Speech-UserExperience/Diagnostic
  2⤵
  PID:1276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Spell-Checking/Analytic
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SpellChecker/Analytic
  2⤵
  PID:808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Spellchecking-Host/Analytic
  2⤵
  PID:1904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SruMon/Diagnostic
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SrumTelemetry
  2⤵
  PID:1472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Debug
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Diagnostic
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Operational
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Restricted
  2⤵
  PID:2420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorDiag/Operational
  2⤵
  PID:4060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorPort/Operational
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Admin
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Analytic
  2⤵
  PID:1392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Debug
  2⤵
  PID:5020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Diagnose
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Operational
  2⤵
  PID:2784
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Admin
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Analytic
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Debug
  2⤵
  PID:3832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Diagnose
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Operational
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Admin
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Analytic
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Debug
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Diagnose
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Operational
  2⤵
  PID:4452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Admin
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Analytic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Debug
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Diagnose
  2⤵
  PID:3612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Health
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Operational
  2⤵
  PID:3420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering-IoHeat/Heat
  2⤵
  PID:700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering/Admin
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Debug
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Operational
  2⤵
  PID:3132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSettings/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:2832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Diagnostic
  2⤵
  PID:1812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Operational
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Performance
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-ManagementAgent/WHC
  2⤵
  PID:4696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Operational
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Store/Operational
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storsvc/Diagnostic
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Subsys-Csr/Operational
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Subsys-SMSS/Operational
  2⤵
  PID:1308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/Main
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/PfApLog
  2⤵
  PID:4032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/StoreLog
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysmon/Operational
  2⤵
  PID:3616
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysprep/Analytic
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-System-Profile-HardwareId/Diagnostic
  2⤵
  PID:2400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsHandlers/Debug
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Debug
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Diagnostic
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Operational
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Diagnostic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Operational
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msctf/Debug
  2⤵
  PID:3028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msctf/Diagnostic
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msutb/Debug
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msutb/Diagnostic
  2⤵
  PID:4924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TTS/Diagnostic
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinAPI/Diagnostic
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Diagnostic
  2⤵
  PID:1672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Operational
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Analytic
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Operational
  2⤵
  PID:1624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZUtil/Operational
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Debug
  2⤵
  PID:2136
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Diagnostic
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Maintenance
  2⤵
  PID:408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Operational
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskbarCPL/Diagnostic
  2⤵
  PID:3680
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Admin
  2⤵
  PID:3276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Debug
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-MediaRedirection/Analytic
  2⤵
  PID:3488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Admin
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Analytic
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Debug
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Operational
  2⤵
  PID:3176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Admin
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Analytic
  2⤵
  - Clears Windows event logs
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Debug
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Operational
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Analytic
  2⤵
  PID:1044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Debug
  2⤵
  PID:2668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Operational
  2⤵
  PID:3548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture
  2⤵
  PID:4572
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
  2⤵
  PID:4072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic
  2⤵
  PID:696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug
  2⤵
  PID:3972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin
  2⤵
  PID:4380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic
  2⤵
  PID:916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug
  2⤵
  PID:4640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational
  2⤵
  PID:3512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Tethering-Manager/Analytic
  2⤵
  PID:1852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Tethering-Station/Analytic
  2⤵
  PID:1780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ThemeCPL/Diagnostic
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ThemeUI/Diagnostic
  2⤵
  PID:1156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Threat-Intelligence/Analytic
  2⤵
  PID:1088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service/Operational
  2⤵
  PID:640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Admin
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Operational
  2⤵
  PID:1308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TunnelDriver
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC-FileVirtualization/Operational
  2⤵
  PID:4032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC/Operational
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UI-Shell/Diagnostic
  2⤵
  PID:3616
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAnimation/Diagnostic
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Debug
  2⤵
  PID:2400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Diagnostic
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Perf
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIRibbon/Diagnostic
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-MAUSBHOST-Analytic
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-UCX-Analytic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBHUB/Diagnostic
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBHUB3-Analytic
  2⤵
  PID:3028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBPORT/Diagnostic
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBXHCI-Analytic
  2⤵
  PID:4028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic
  2⤵
  PID:852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UniversalTelemetryClient/Operational
  2⤵
  PID:2260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Diagnostic"
  2⤵
  PID:392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Operational"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Admin"
  2⤵
  PID:2020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Debug"
  2⤵
  PID:3472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Diagnostic"
  2⤵
  PID:4200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Operational"
  2⤵
  PID:380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Analytic
  2⤵
  PID:1456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Operational
  2⤵
  PID:2780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserAccountControl/Diagnostic
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserModePowerService/Diagnostic
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/ActionCenter
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceInstall
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceMetadata/Debug
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/Performance
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/SchedulerOperations
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UxInit/Diagnostic
  2⤵
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UxTheme/Diagnostic
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VAN/Diagnostic
  2⤵
  PID:3984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VDRVROOT/Operational
  2⤵
  PID:1724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Analytic
  2⤵
  PID:1988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Operational
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VIRTDISK-Analytic
  2⤵
  PID:4384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN-Client/Operational
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN/Operational
  2⤵
  PID:2488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VWiFi/Diagnostic
  2⤵
  PID:4496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Admin
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Operational
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Volume/Diagnostic
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeControl/Performance
  2⤵
  PID:2036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Analytic
  2⤵
  PID:3064
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Operational
  2⤵
  PID:1096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WABSyncProvider/Analytic
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WCN-Config-Registrar/Diagnostic
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WCNWiz/Analytic
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WEPHOSTSVC/Operational
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WER-PayloadHealth/Operational
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Analytic
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Operational
  2⤵
  PID:1228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-AutoConfig/Operational
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-Autoconfig/Diagnostic
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-Driver/Analytic
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-MediaManager/Diagnostic
  2⤵
  PID:4908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLANConnectionFlow/Diagnostic
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Debug
  2⤵
  PID:4964
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Operational
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Trace
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPDMCUI/Diagnostic
  2⤵
  PID:1436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Diagnostic
  2⤵
  PID:880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Operational
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSSUI/Diagnostic
  2⤵
  PID:4952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-API/Analytic
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Analytic
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Operational
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Analytic
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Operational
  2⤵
  PID:3724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPBT/Analytic
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Analytic
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Operational
  2⤵
  PID:3460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPIP/Analytic
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPUS/Analytic
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WSC-SRV/Diagnostic
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WUSA/Debug
  2⤵
  PID:4028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
0a7c97310b0add1ada23ec02bb7f14af

SHA1
f09243418b7c58e847e32f6290463ae1b0e9d1d4

SHA256
694de6583a4efbd8713a3c48fc818c9eae2499efcb5112ba0f907b76e4a5b68e

SHA512
dbd76e5d308fbd02f930ca390e733a3529d38a152b60c163d0429be9646897eff521a1e14ab8d0b605b8767f1b74494b4321d85c552588930090ad2baa72856f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
454c5c4b128d34aee2eb765f2a9c0aa9

SHA1
4b6e92db79d964f604fd6b261b3b19ede2aea8a5

SHA256
e1e65d1697b9ac59805f677cbc8eec623a899b75b1389354f0948ad3c1513772

SHA512
17b4e146ef4f8862d06ac975204cca9ef9b077420256df92d94409715b18efb4dc63879154c1c234317a169ac63024ed43b5cb52473882dc46c588af089f25d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\25xjr4by\25xjr4by.dll

Filesize
3KB

MD5
158cbce5ee1e7b2400c58147426f6852

SHA1
119e447854d53dba58654fdf24ad95af2260df41

SHA256
337e4d3377ea9c791c7baca419b740e86bb140aef96640f16aa9f14e2a2142b6

SHA512
16e9c989bebcd3b2384210778c522506b657f5a0d0b87d8e9829b07ceeafba4765a1ce15923cad7be36d7822d474f388b9eebc6c43ecdad30c751860b67cdf7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3nczzkah\3nczzkah.dll

Filesize
3KB

MD5
568620cd458095ab803a6f4c1f38c827

SHA1
03235b8c2b56ec67ff3c0bab6f1f1ee37a7266f3

SHA256
6bd221daba457b5306dc96e86b6e96ce4f39fd5f9b79500811f9cc2583c62e47

SHA512
fa8c6f0d9f61fe583fed3f33719623c9610533a5dba65c24c03342598d4595a1441aa9a0c6f5a17316065007a1d53f4c330df87aefa36c9b947239bd37ff7bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\3qaeiub3\3qaeiub3.dll

Filesize
3KB

MD5
b8fb955b2e973325874761118b2bd199

SHA1
e27a6df08855a78a3a55e00b40593e65f843fe87

SHA256
3d1ef2944103943839f8c340e2c0ff8f179bcdd633f6db4287b4bea8ea8daf9d

SHA512
612c1f6bee91dc67fe37906b55ff6c3bc973ebf5d869cc944c6742d2d9e0641950da241c2e3c36bf252bc31fe1c9c98de13646dd947c349cf483b61c4201037a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES126A.tmp

Filesize
1KB

MD5
fb5be71e092727c199768ac6e58b433d

SHA1
698f64ce0578e6e515dba8e03df627dee9eb974c

SHA256
e05e7118df793b4f20dede29aa99e46324d41eb2bc30df376f476f9cbab29d86

SHA512
13e6554774e50e322df5b8dddf58177a9e733da7220599a508d0ee75411e3284624e4bdd2ff564163807ad9eee1efd3bf312297baa2304c1fdce8ef5c2d4da7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6368.tmp

Filesize
1KB

MD5
a2e1a7ab6a0e6b22108cc82549053de3

SHA1
2f44c54363912c06c52b9fd0edd92b4fb6bebb67

SHA256
6dcc13a53de545e20417a2e3f093d403a3a34bcdb0f3322a51b2f2558f4104ef

SHA512
53db3fc12f45baccc7dcb39233c256f33d1a88f9ef6fa16bf442a41ab24076977085844d9fcfb16da0e52d2e7a2afbff58ddbbaf6e8efe780c40b5e1d8d64438

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES64DF.tmp

Filesize
1KB

MD5
82426cd2ffd588095de8c131c2dc8f96

SHA1
84918d32a2482296abd346e28bcfb54af0856a20

SHA256
02d66f63e481d6dbe344a6aaa71728e6e9ef0e91aa96ed1328617ff7c9bb4836

SHA512
9a2eda89243073d8fec36d71989189c0c87baaa911bad6a931d03b0b78d74ea010cc915a6f1345484a7aef7c7927666400e248c0c6362fbc9272a0fbdedfbbbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES69E0.tmp

Filesize
1KB

MD5
f8bd381093fc90cb5daf861ce92cc647

SHA1
f10bc77d218651270fda3c9ddead6b9e8ee387ab

SHA256
c41adc5d7ec620539e333f710aa65b8eee70826330b47f6842369329d01d146e

SHA512
00734472c18e922350d131689331df8886af186a45cdcba2679d4b77dc30c96478a6dad8f8b780afc23b35b39bbcc4b2a94bf9481874b7f4d24df0b895fa826d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES78CA.tmp

Filesize
1KB

MD5
0b6db6b19ea2d98516a307d4f02977ac

SHA1
dee5e19d1771bcb0cd07255e145763126c882986

SHA256
024334f3b3b6e0863a2dc80ae758f0fce6a19c1281878fa3fce413997b557f0d

SHA512
f5bc980024ebc354d2c9899165802dade5b2125230e8a0479c4047682230a45565f8af0d2766726a96b9d787e6457ce88543f70f86428c6ed074f5ad4756d6a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9EE.tmp

Filesize
1KB

MD5
d84a4769b1408130fadc5a8dac92737f

SHA1
2abe877600fd8b38fb54fe96c9e7c43d0a7b179f

SHA256
6cb6b57b0899289340ad171ec4ad86feda97bff7054f3ec7e146c944a5b9c625

SHA512
6cd52c88482612bc6f18ed50bc7cd71a836eb98cd1e23fe57d74347dea5c7177eba1eb11db39439fe15ca896667f969beae65e534239678c52e3a9260732e9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD49.tmp

Filesize
1KB

MD5
403b91395a319355cc3b8e34f62b6219

SHA1
f2072f2e5359e4e8db2905b904f949b9d39665dd

SHA256
ecb12945d1b69fb897414fd0095cb335c63a6daef4c344d2680eafc9594d8742

SHA512
adb1f7990626a9dd5c0ba84d940000fc41447691ebca39c467a8a75e752d3008533b759cd0a388416c6b3825c8404b952ed01c0a582c5dd9b43792496b961d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE05.tmp

Filesize
1KB

MD5
92fa45720f96e0f33288b44058d6da11

SHA1
abf4f9b093af65436c79afbaf7ceba800d89a310

SHA256
a430a048ece24bf7798b7de27646313b4d1442f0b6b3ab2d5f3c3433a57ad242

SHA512
a9b8289e1be82d8be22be120e8899792d41873ed903c8f14a529c29b6f79d5b46e2ebd314e4d6909043b58a26cb4fc6cba429a6bc74c3a73959078175fbcd3e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEDBB.tmp

Filesize
1KB

MD5
a1dab5467f829367a15d6f80a79c703d

SHA1
c51fc3a7a5f92b3a7fc0f6246f85641e60c98be0

SHA256
3a104a9ea717e5ffac1a42b3b09473ae732bccc2110079238dc99d78d48c0d32

SHA512
7a2992c3e769845e03e4c6107312d1624a60ecfc8c0189ae412e8e93739feef3ad453119d678167f91d71658441edbe8bbab01b1fbbf7b93164cb9ed67cfccbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_neosyekj.hir.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bpgohcre\bpgohcre.dll

Filesize
3KB

MD5
517aadea7c8089753318230eb348aff3

SHA1
29a482a9cf2029be1025d40147b2a579f2d6b0dd

SHA256
436755ba0284accb6c771dae1e79a69f182418e815a4950b4732b84606b710bb

SHA512
68e390abc54b4eba35d61cd1a387e49ae3f54817767294ad60b2931b0853a874fb6d60f6776d6f33782770ebc4ad93bf94e749f618feb5ed6e4dc82d27eaace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\btgcr31r\btgcr31r.dll

Filesize
3KB

MD5
b6cc46a219d04e0def1f95857bcb10fe

SHA1
cbfc6f764c60e961dd6f197dc5b472ea47162f8f

SHA256
53e181bb9416de2f2ae923b4f9976b5bce9490f2ae766f59e031cf97f89b8ce3

SHA512
69fa74f6ba914db029caed4c9b58b2fbc8eb03439d85bf7bbcabdec0c1ff0b9289223c8907ef4c7db1668634d68f4a72d7e1c30e36ac04ecf50523b2b0de30c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gqx2bcso\gqx2bcso.dll

Filesize
3KB

MD5
e6a4003dbb5953f5a5f3e6469dccb661

SHA1
44524408689462f1465cf14db74507611b8615ae

SHA256
1cb81a7ec472fa8121a36b5f9e92c370cbf9bab8b67950390bc12ef86502d390

SHA512
e40d885e6458438b7053f19460e51015a369e8e43c64717af6171f16c63c8a6271d27b3a667991549c426101022525013a89fa1a4d8c349b6cf849f6ef7cd29b

Download Submit
C:\Users\Admin\AppData\Local\Temp\r1gbdnv5\r1gbdnv5.dll

Filesize
3KB

MD5
ea42e1e7e7790c8c7b146028e1611258

SHA1
7fac0d7dc8671f5265d3694eb5fa87780f691433

SHA256
832078dab92a5ab3b7e532c77d4e14ad50f4e2fc5049790cba6c8b10621b88eb

SHA512
936a689f52c4c792cf6343a3f592aec988cac417a8330798e16104bb6661c4a112370bbefeb1f6c298654fc53bb0fb3a1984709961519566e1fa981fe1caf29c

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2yvq3oi\u2yvq3oi.dll

Filesize
3KB

MD5
d7c37a8de4aea130fb37457971fabf92

SHA1
4cd2f8bbb1dbcfc3d43a4635469f52fc149c68eb

SHA256
03e77dda305b0534989e8824e745eead59abadb48fd8bfa722d15ae06ab430cc

SHA512
ddd1c4d170f3e3f77a0705433546ba591f2159144f0d2f6a73561db7bf15bfe8333e25eebe24618e67842bbb03de31e5f86dd850ea893a61cb8e5defc92ce19d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ziigyxrm\ziigyxrm.dll

Filesize
3KB

MD5
74b46ffcd7462e9ed11fd1e321b52ffd

SHA1
a005b71f9b3171208cf7b266fc24d98d97e57812

SHA256
b6807d1d2c65f9bf5a804d0afad186ce66db1eb472733c51499174085818070d

SHA512
8113726e501161826b46a368949673291b0361f1171e88871d8aa63b7a4efbb8e81325addd69bdb59478c10addaa37ae1faebe26b09828249b2f63e0ae00b1bb

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
829B

MD5
e5d10a0c76f0f06e717c4d5dd37ff943

SHA1
927ada9c0e759bcdfefe951d8f25852353178410

SHA256
bfd71678bf2fa37e5fadc5a540629fe1844dff047e165546f0c65f76f2f2f582

SHA512
8947bff67db205b544b1eb93f26aa011ed2598b4310751844fc1adc6be6ab3663b35d2ea9743a3b8dcd5e18ad9cf461111cf8259bd65b5aa588298cce124f7c1

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
892B

MD5
52822b2a0d54d645a8e3990ee808acaf

SHA1
d4ac86986f12bbec3b8719cbc4a3ffae9753b0b3

SHA256
793fadb7cc88bfe328789a735d4cc7e9f570a8e892702d7c907a6d409666ffcb

SHA512
9e4bc7a74546779995966b7da01f583f04074b7dc26cbfaf9895aacc090989d80934c88411c477e25295bef34a9e1797f7b9b623fcb2ca10be82fff4783d25ec

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
dbf22bc226dcebf9b82a01135e25065d

SHA1
886234f152eb058769ca80825fa445f989ff5456

SHA256
b88f789a686d272b7de481cb43a7b58e92a7f3bfa79af41893d07b9d64a849f7

SHA512
5e55d1d28bc9660eca512231dcc094c0947aa72c310a3c54288600362c06dd88de8043145a15eaba9dcde20afdeae3bb534da81f39594f86e19d6a250880da79

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
f13004d7940f404dfcef26a8c408a1a8

SHA1
1ebaeb631f34490e5686c453f60538bc4243aa22

SHA256
116f91cc7598b9d1f75e681eef9a058851e59d7754dec552f970dc9819973bc9

SHA512
f308635efd96432645993193bbb94b256fe77e4e55c5fb4e4cbaa8e6659f3ffec60a9004e60d1685ff880526cc10e91d2c9b5fc3f9c4110ad1c1748b5cb21e29

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
7e23c16d09405ccaf48e368b57274d90

SHA1
e2c74e1e7d9891f6a42d99626e1363c40ae921bd

SHA256
8f40663ab0a329dcfa37a2dcd36fb8f3b783931b5a8f445312a97608c0a8e306

SHA512
74a2f602d12254312c218c72a70a81817773441629744356c907c9fbdaae82235b17de273ff52491951cce38b26a3c060a19f4519418ffae1894632c7d0196f4

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
0a5a41e68b36c79a82bcdf3e069ee6ef

SHA1
286e0358d9332d0b03fb31b5297e06e0f7866ffe

SHA256
be7dc88b603d32aec517d2feefd038a6d777cdb4714329d6467128dc5abacced

SHA512
f40d6c3441d8e11d54239d043356643b9ac3e57955c5c42069d24de9a400db6b938f2b48f5197255cd4bccbfc61f19bcd5399597c0281f8fd5def92dfd7ab284

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
ff4d4d79f69d5ab30f42ce22ab0009d8

SHA1
bc92c4f317774267c8b55fd33d6813dc023fc9d8

SHA256
3bb04a31077d696a06ee1e061369abb7cda56bda7950aca8890739db4b513974

SHA512
676d2204e5d8f35b1a62c0a1302f745a56102c7c5b91c5407bb677cec82fb5a52560f91ef50a2192a511a8f98e526ccaf83935a3134b3d5b969f607d542d5089

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
2KB

MD5
067c1765418c557064c13b5cf48a9dbd

SHA1
6b79613a45da90c38ed27c3b8a6ca464428a40fe

SHA256
1d3c94454fa33823fc8b67c1b84214f861dc3a03c1cc5ab27c13baffaa695f43

SHA512
83e12575ee23b74586de623a696fb16d374f1cf52459eb41de6f07e11a14dc4bc7f310679dfbdd152da1b86a40a7f96efb5131a39a862d3d44ca4acf0b3a8f57

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
2KB

MD5
57ca22e1d84c0d8c3ce27381cb7b8406

SHA1
d1543db722492780224af0f7385d9c55644fb36b

SHA256
0a458f4ec22d3aadf412bdebf51ee4a2ca447b81f1f55401c40688ca49fb885b

SHA512
3fcce2322d7a38a2cb908978db7a37d81f334359c31f9704e55ffbbd2c65b627591b9e1b769a8c5bc104b0f2186d2cf2f0f96c82d34a3a9fdf22ea3253d9bc33

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
2KB

MD5
867271480b38ab927624c47b0b7bb7d1

SHA1
8378c87ebb4ff99751f06b981e57f88f8c35a593

SHA256
1eff7d79f9c5b712e2a42d2c6e4d25182d474ac7753541f93cfc51455f7e1dfd

SHA512
17b5df1fd711e1f7db5b1082160ba7aa1e1d213ebc39209b63ab1369ff074095b77030944a19ca765f355a029a03032ce28f2d62508b6ba414ec060387983fad

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
4KB

MD5
b86a0636dccd617862d31288a4ea38f3

SHA1
dd873de03b1943c37af9edfeeacd05db2e2c1754

SHA256
3da4f9a2e26a4fd5bac5e6774a36da9a22a011cc62feb87908805d17f1f5843c

SHA512
45506865356bc834cfee6c8e70a60534789fdc0f812ea7fa567bed436396477e9d8084e5b64d224f9876cc766eefc757cfdcd5c9c258311cad10fe05dec0efa1

Download Submit
C:\Windows\System32\AlertAleph-lCJxeGTW.ps1

Filesize
34KB

MD5
264c23138c8fa42c5349b813eaceadef

SHA1
9b6775c974c762e3623e5a4d6a5889abb4c5483d

SHA256
0d04aa56dc4d408adec27419813e9ab81841a0df73fc8a27844eb930ca7b7d19

SHA512
4738506caa97ca0b07fc929abef76d8f1e9ef13139701101985457763a7cc5d13536f336879f2cab966618f55aa451768be646e04a98876a0ea2d8476384dbb6

Download Submit
C:\Windows\System32\config\systemprofile:Jakatatales.ps1

Filesize
34KB

MD5
cf8cb32afda5defb402264f9e35c7911

SHA1
d8281ddbff4f390069ea07c4f85f3bb246c07e6b

SHA256
c3a49abe4c3c04e9eda322b94a3ba677fcb4e1d35ae4af35e8f77bb7933e358f

SHA512
a7581bbeec8dd3197d61d46fcff5708e0812781a8f8a0d539265c306b3c8e8707dc3f24bf0f5a3c3eb3b3b3d474fcb87cc4af03257ab82bb7c03aeff0d63430e

Download Submit
C:\Windows\Temp\ArataProtect-lCJxeGTW.ps1

Filesize
649B

MD5
032032f86635c74b3e15aa86db6f14e6

SHA1
5718a3ebfd24f1f16428e92bbe203160e58a539a

SHA256
a7b0b3eb1f96893785155fc7617b150cc47a529b11345e1e01289cf343a17025

SHA512
6c607bac69d940ac87f3bba375566801b0b1e445c9d8279e14615db48ce4231707a63d8649fccc539ba6095b5e281d928433e98530b83c4c722bd24456992f92

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\25xjr4by\25xjr4by.0.cs

Filesize
249B

MD5
7df2964601813e20ea90bc7eca64b00b

SHA1
a8ad7c0e81f3b6edd66269283ff1603491edca3b

SHA256
daf8a1ae523190ef51054e143909966e01c3b6f531c72b9524d91254eacd6084

SHA512
4970916854df38bd3e55021c3d4f802b3db5a4d64a4570817edeb8c42d6e335a4e989bfcfdead96c2ee8776cc54ad09ef609090ccd34b849532d5f3f6caf42e0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\25xjr4by\25xjr4by.cmdline

Filesize
369B

MD5
9e6bfbd563ec31bff5c8ae3e7f71431b

SHA1
1c5402cbd733f9c041fe91483a0b22f8411b015c

SHA256
73b1302ffbd754b0bbd271b7a7f3b559ad858e8fe1af46c41ada3d992d3903ad

SHA512
0c413ee411daccff08d5c32c9ace5338944c243969cf39d09c402eabcc4c1d35e4f9e819a8687aae2036f08459fd47e3c5cf887322d4563579a26973b8ca9299

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\25xjr4by\CSCBBC2FE07A64B44BEBB8FBA54341A2715.TMP

Filesize
652B

MD5
7dec7207aefe0e5df2c61d5cb993874e

SHA1
af5978f4cb93cec681bde2ff5b6a43e9f17d2b2c

SHA256
e1cee30c459645705c1835518d4b8a0c4b4d19ee162470669c1d127e28218216

SHA512
e10498e1dbd8b9b407c6f03b40accdafa551fd00b48600f870047efb6359078a3bebd5cc0ef4811691fd697520de6d69b3069e030c650f1949ba1756c0939e97

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3nczzkah\3nczzkah.cmdline

Filesize
369B

MD5
de13c92a8c89fa6897b0e4ea488e1f2a

SHA1
d91603b301a1ad44e7b21e6c804a45026659552c

SHA256
60b5d6a5e977c093a3c603687222bdce56419105a6455ca7dad584ae0dc54f94

SHA512
b34e8586ee24330eefc047c80a152f2c91448d006b1545a7d4bcac45af83262204d04fb74bf5a060a83b592c3aafe8b1cfc7eae1a5bc76ccf226c10cf8aaa21f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3nczzkah\CSC41FD54E8762A49028ED7FD5994588B8A.TMP

Filesize
652B

MD5
d3d8a8b69050f0d3b8e78f8a29d9b140

SHA1
4a4975b0ceefed6555906d0fc01bbd7c1099bac7

SHA256
8db4597d5db44e4172008367ea2d8d957ca23a47dd02669e8a7ad0dad6a1f91d

SHA512
4e2fb9d46bdeb1ac8932c1932fc2dcd62017e21c56b2e4a32b7baedb600ebcac494fac576b1210822f1486ad7adcf80e2495ad1412bb5ddd54695d4e1a277a0b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qaeiub3\3qaeiub3.cmdline

Filesize
369B

MD5
66f25e423595e62323e9e282c0e9ae8a

SHA1
8c2663c2d913e3c25ee905c483e8e2b23a14b469

SHA256
dd2ecc5275f5104bd2d105de915dd40563655ea98c2a7613cc21d6d01fca6ee7

SHA512
a00ed9c3337880f099ab45fd7a55115aa129ffc6a3f01fa5d5201f05f4cada9371002d980a05228d47f221efacca50e3976a77f7a87edc26c0a8d2dc62ccb382

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3qaeiub3\CSC509E30D6132463BB4D1F36D5F70BFF8.TMP

Filesize
652B

MD5
151383730d8fca8ed6522ff49a335b9d

SHA1
83ee3f67b3f2802dcd81febe49ed59f4f0ded895

SHA256
bfeb770c0a8432cbe625d3dbf0c7609c373da9d55cf10a418513b5bdc757e71b

SHA512
1db945e499307dca999c432f9679221c1ea2d06824a0d748edc2ea8ea4366d38d3eddda3ed9b91fe7afbb6d5aa6fbaee8414974044bdbb219c4824f79e7e9ce3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bpgohcre\CSCABD622B44D74409ABDCAE51DAA2528D6.TMP

Filesize
652B

MD5
ae6a963fea4bd6582809833b79008baa

SHA1
33b4a5a063f787d7751564185edab6df20293e82

SHA256
4c8ba2c48cfc4ff6c7684ef124dffd3547dc21599cbd05e4eac1e6414e737f3f

SHA512
933c9a1ddfa16a8b3aadfa9bba8993e3b874dd700160d8c85d0179105e436902547a07f9196d4fbd5d7940e7d3cfb30aee0a190ea54a678554b98db3ade932a9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bpgohcre\bpgohcre.0.cs

Filesize
425B

MD5
bf0bab0ec41a16f88aefa9f29543514d

SHA1
432334393245d6f0c05afc6cd07c99f4eacfaca9

SHA256
2eb1b6bd7727d8842685e02140e0a79c8e99aba04205acd4eb3e51250de5704b

SHA512
dc0c3b44989453ed2f5c8dda5b8a15041e58df27bf39475df904eac1df0ab058c221bf005d7814e30678f121e2b3a6b7c002a0b7be8408e5704a2dbc2e7c4bd0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bpgohcre\bpgohcre.cmdline

Filesize
369B

MD5
db2ca5d92c4e7d6b5747839568bd6c7c

SHA1
9c80d53c6052a11b7d893b9505aee5aa47608977

SHA256
84488c6abd5b90d72b8318b976e40d486d4a1af21c002156c57c51850908189c

SHA512
3e37ec29ac22d3c134f3039b54ab84ca248d85c30b0dd4bd56541286e6a2c801cb9a65e8497c7c91bd281c83300ed2b8676b8bd9cc813c302298e4ab1cabe1a1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\btgcr31r\CSC834044BE9D8345D7A3412D289447B68.TMP

Filesize
652B

MD5
6c233c3f96ec7b56e91f19efb3f84993

SHA1
a90a368877a3baa8c3ceee44a7509e05624fefd6

SHA256
cbbd4de399ed600702e5626b34cf54059fe1ee940716175971f4aba0373ff26f

SHA512
b2986ccd3887b2d550d37df2d35ef44a8ed3e318359befe83d9fd41b161be30c3065eb73fe81e060e05e786e98003583c1764ad78b737a76f804166921ab1982

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\btgcr31r\btgcr31r.cmdline

Filesize
369B

MD5
579a6c7128a02d85d9a7e8f93e770623

SHA1
340e00ac9bc39220864ab23b16f512b22fe66743

SHA256
387e11c5a4cf5280f43fb6ab0f242ea9f63452bb1b17001b3fe960e416efd3aa

SHA512
1f5fcf865e5ea160e635afb43a0c6e5e8a21b3206f3cdb4787e7ff5f7b5c27349cdb100698beda0cfaed6b6dce81a3af8792bc7ff1c54a5603f8a48b06547d96

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gqx2bcso\CSCFAEE744AA8F64B42B1B3A1A64991CBF3.TMP

Filesize
652B

MD5
f2094aa91d4b937b71e2da6ffb237665

SHA1
18aea2d3272e98a527157e9b89ba5af677d397b3

SHA256
7cc40c4d95459117d6d09d6dbb676e7a358cfb2c3288922dceba0c9070440438

SHA512
f9c576a78928b9f3bd04cb88b589173344a2e5b721cc692b3b13dbc0d0ac908626d8e19d6e6ff27ab2e9e5b17688c8e901106a29a40e7dd39c248443c9235394

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gqx2bcso\gqx2bcso.cmdline

Filesize
369B

MD5
60d3a6c663edbcead50001a682b510a9

SHA1
9431544054d70938d823c23fecea792e3cb5223c

SHA256
c627810d87328ea7a18d23a06f83f5f3a2fa6876da62db974bc89a74a3fa03ee

SHA512
916585f3429858d317d098318342823563f5109cf8b5f77ca4c8dc18f8f9a1f37bd042f4b4187683484d8cb8c4f8caac56e44ea1c14d2532af1f7bd274754a90

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r1gbdnv5\CSC5C769327B2684D1DA0D73DEF4DBE6A1C.TMP

Filesize
652B

MD5
fbab5d89f57708a896ef59211b2611c6

SHA1
614957b0d8d90bd7932509d84672b9d863bce646

SHA256
a419950be64a5db61e151966afa3dc841b5951dddfa0116a7514c7a7288cfa46

SHA512
10c56cec5a54a0cd31b66f53a36492e2d1bf64feca8482bc5f6ed81f6b083045deefe4372f9996e450c386fae113c956f7f4fd4a82f6fa955dc37461593762f9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r1gbdnv5\r1gbdnv5.cmdline

Filesize
369B

MD5
78e866af2b54796e21a92227b92964cb

SHA1
dcfb348640d1ea07b8fd63dea78aacd1ea51883f

SHA256
5dc5f3b73b5190a1ea1e9453c7dd8f3a509fa57e27f078222779309c4e9bf861

SHA512
15757d746bf41fc83a005bf3398f3a39ffb49d609e384a1ea57f5393059d9917208a363d29891fa6bef25e77b5b577747389d793323c2a48a7c052afd26a28e1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u2yvq3oi\CSC8FC3FB38CF6B49CA865693464C392E52.TMP

Filesize
652B

MD5
14a3409d75e02b78b48ffad8583c1075

SHA1
247502f03c5228097d31d3cc8b0ab44912c331c9

SHA256
8b129ca55fa0a36bf2b858a062b7558c80edda5cc03fd385f1d4fd79de0575be

SHA512
94187f812c8b1b32bae4acc96136e28e6cfcf8c2f48bfe6f1cfd1051264ce903e969a9dffa9040ee51a2f10752edd529c6c40e332f093ae2fe674355353ddd0c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u2yvq3oi\u2yvq3oi.cmdline

Filesize
369B

MD5
e150627bd27657e133cf7f0b1ad761fd

SHA1
dbf10448881bd79f63c53dc7ee85a8c35b29001c

SHA256
f7f43e6ae6417bc3117ee1464f604301b1a501be093fbfaa4144f48a3cc65a84

SHA512
44bca1ea0c1f60366b80630873a7f45ed95fbe7aeedd641e48b5d470b951c4670a89814e750f8d9a913b86915b0e7ba9586a60227d7ee784ba3acedb4f73520b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ziigyxrm\CSC6E9458CFBCFF406080E5382291FABEC3.TMP

Filesize
652B

MD5
ab5006a6ef634a914074201bc001d860

SHA1
c38e81221836aeb08e4a01ab917a8036048ef374

SHA256
acc00d2f2c964c93156e2ad91af3054b72dd977173dd54941d62dcd94319c084

SHA512
0ec287dd9b7d07bab9a618ebab520bbef9d89f7b34c8af01767c9730fc6f840483214155bd7744667112f7d52359c1adb880b971172127cae05f65bcbc18128e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ziigyxrm\ziigyxrm.0.cs

Filesize
696B

MD5
b794645974059bd125405f327c5ace77

SHA1
d332d8821d1eee8e5db75ec151df5ec945bec334

SHA256
afd81c914fe8fa7ee32be6a797f46a2a829908b45d59100c1052a7baf2a347da

SHA512
dc8e4aa0b35a02d7f43868bce8602ac3941341f74e2f2de6bb79dbb8eb9372431cd7179f3701a09d574ea449735738d9ba368b78fe4fe7fa6f9856536c19f8f8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ziigyxrm\ziigyxrm.cmdline

Filesize
369B

MD5
8535b710316be093a65e1da3111fd469

SHA1
6fda5c1a79b1df9ebf09a7d15dd0139d67c4f8cf

SHA256
0ac1e35af3fef77ea0fbfedb0df6eee656f2c8a821398dbdaaef744d6fd1607f

SHA512
a20c664d7876422e3e37a862ee87e9d93bb09a5dd26970e398ed22ae7f90c70befbc446d592c98e973b3f5dd4ce4f697c038eebec11407fc9aeb95371fb0f155

Download Submit
memory/464-10-0x0000016BD6F60000-0x0000016BD6F82000-memory.dmp

Filesize
136KB

Download
memory/464-12-0x00007FFA2B070000-0x00007FFA2BB31000-memory.dmp

Filesize
10.8MB

Download
memory/464-0-0x00007FFA2B073000-0x00007FFA2B075000-memory.dmp

Filesize
8KB

Download
memory/464-25-0x0000016BD7190000-0x0000016BD7198000-memory.dmp

Filesize
32KB

Download
memory/464-27-0x00007FFA2B070000-0x00007FFA2BB31000-memory.dmp

Filesize
10.8MB

Download
memory/464-31-0x00007FFA2B073000-0x00007FFA2B075000-memory.dmp

Filesize
8KB

Download
memory/464-11-0x00007FFA2B070000-0x00007FFA2BB31000-memory.dmp

Filesize
10.8MB

Download
memory/464-77-0x0000016BD73D0000-0x0000016BD73D8000-memory.dmp

Filesize
32KB

Download
memory/464-48-0x0000016BD71F0000-0x0000016BD71F8000-memory.dmp

Filesize
32KB

Download
memory/464-32-0x00007FFA2B070000-0x00007FFA2BB31000-memory.dmp

Filesize
10.8MB

Download
memory/464-33-0x00007FFA2B070000-0x00007FFA2BB31000-memory.dmp

Filesize
10.8MB

Download
memory/464-34-0x00007FFA2B070000-0x00007FFA2BB31000-memory.dmp

Filesize
10.8MB

Download
memory/548-719-0x00000235E8B90000-0x00000235E8B98000-memory.dmp

Filesize
32KB

Download
memory/740-1259-0x0000026429E70000-0x0000026429E78000-memory.dmp

Filesize
32KB

Download
memory/756-537-0x0000019A42770000-0x0000019A42778000-memory.dmp

Filesize
32KB

Download
memory/2020-178-0x000001D21F560000-0x000001D21F568000-memory.dmp

Filesize
32KB

Download
memory/2020-320-0x000001D21F7B0000-0x000001D21F7B8000-memory.dmp

Filesize
32KB

Download
memory/2020-214-0x000001D21F760000-0x000001D21F768000-memory.dmp

Filesize
32KB

Download
memory/2752-132-0x0000018074AD0000-0x0000018074AD8000-memory.dmp

Filesize
32KB

Download
memory/2752-198-0x0000018077B40000-0x0000018077B48000-memory.dmp

Filesize
32KB

Download
memory/2752-245-0x0000018077ED0000-0x0000018077ED8000-memory.dmp

Filesize
32KB

Download
memory/3680-141-0x0000020E5AB50000-0x0000020E5AB58000-memory.dmp

Filesize
32KB

Download
memory/3680-438-0x0000020E5ABD0000-0x0000020E5ABD8000-memory.dmp

Filesize
32KB

Download
memory/3680-460-0x0000020E5ADA0000-0x0000020E5ADA8000-memory.dmp

Filesize
32KB

Download
memory/3684-512-0x000001ABC48A0000-0x000001ABC48A8000-memory.dmp

Filesize
32KB

Download
memory/3708-297-0x000001E855480000-0x000001E855488000-memory.dmp

Filesize
32KB

Download
memory/3708-667-0x000001E8708A0000-0x000001E8708A8000-memory.dmp

Filesize
32KB

Download
memory/3708-571-0x000001E8706D0000-0x000001E8706D8000-memory.dmp

Filesize
32KB

Download
memory/4056-1118-0x0000025F9C080000-0x0000025F9C088000-memory.dmp

Filesize
32KB

Download
memory/4520-636-0x00000205EA500000-0x00000205EA508000-memory.dmp

Filesize
32KB

Download
memory/4836-565-0x00000240772E0000-0x00000240772E8000-memory.dmp

Filesize
32KB

Download
memory/4836-594-0x00000240774B0000-0x00000240774B8000-memory.dmp

Filesize
32KB

Download
memory/4836-299-0x0000024076F30000-0x0000024076F38000-memory.dmp

Filesize
32KB

Download
memory/4956-881-0x00000291C6570000-0x00000291C6578000-memory.dmp

Filesize
32KB

Download
memory/4956-404-0x00000291C6120000-0x00000291C6128000-memory.dmp

Filesize
32KB

Download
memory/4956-753-0x00000291C63B0000-0x00000291C63B8000-memory.dmp

Filesize
32KB

Download
memory/5124-425-0x0000025247960000-0x0000025247968000-memory.dmp

Filesize
32KB

Download
memory/5124-1143-0x0000025247F00000-0x0000025247F08000-memory.dmp

Filesize
32KB

Download
memory/5124-1100-0x0000025247D40000-0x0000025247D48000-memory.dmp

Filesize
32KB

Download
memory/5352-647-0x00000245F6FA0000-0x00000245F6FA8000-memory.dmp

Filesize
32KB

Download
memory/5460-377-0x000002254BFD0000-0x000002254BFD8000-memory.dmp

Filesize
32KB

Download
memory/5460-800-0x000002254ED20000-0x000002254ED28000-memory.dmp

Filesize
32KB

Download
memory/5460-912-0x000002254EEF0000-0x000002254EEF8000-memory.dmp

Filesize
32KB

Download
memory/5484-741-0x000001C2A3DB0000-0x000001C2A3DB8000-memory.dmp

Filesize
32KB

Download
memory/5484-778-0x000001C2A3F70000-0x000001C2A3F78000-memory.dmp

Filesize
32KB

Download
memory/5484-371-0x000001C2A3D20000-0x000001C2A3D28000-memory.dmp

Filesize
32KB

Download
memory/5672-710-0x000002C1397D0000-0x000002C1397D8000-memory.dmp

Filesize
32KB

Download
memory/5840-491-0x0000020AD95B0000-0x0000020AD95B8000-memory.dmp

Filesize
32KB

Download
memory/5932-965-0x000001CF483A0000-0x000001CF483A8000-memory.dmp

Filesize
32KB

Download
memory/6040-854-0x000001AC17640000-0x000001AC17648000-memory.dmp

Filesize
32KB

Download
memory/6328-985-0x0000020CBB620000-0x0000020CBB628000-memory.dmp

Filesize
32KB

Download
memory/6712-1186-0x0000029977C70000-0x0000029977C78000-memory.dmp

Filesize
32KB

Download
memory/6780-850-0x000001C1559B0000-0x000001C1559B8000-memory.dmp

Filesize
32KB

Download
memory/7004-836-0x000001EBFA700000-0x000001EBFA708000-memory.dmp

Filesize
32KB

Download
memory/7312-1067-0x00000212B5140000-0x00000212B5148000-memory.dmp

Filesize
32KB

Download
memory/7396-1003-0x000001D0DBE70000-0x000001D0DBE78000-memory.dmp

Filesize
32KB

Download
memory/7396-1215-0x000001D0F73A0000-0x000001D0F73A8000-memory.dmp

Filesize
32KB

Download
memory/7468-994-0x00000174E4700000-0x00000174E4708000-memory.dmp

Filesize
32KB

Download
memory/7540-1285-0x00000223C7190000-0x00000223C7198000-memory.dmp

Filesize
32KB

Download
memory/7740-1061-0x00000189D12D0000-0x00000189D12D8000-memory.dmp

Filesize
32KB

Download
memory/7872-1022-0x000001A6EFB50000-0x000001A6EFB58000-memory.dmp

Filesize
32KB

Download