1e6a72c58db5d7224f81cd51b0e2b591b3469c838d2e1bc64d06d64a666657fd

Analysis

max time kernel
25s
max time network
33s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Verdacrypt#232.ps1
Size

34KB
MD5

bfb119ecc5767fce155199d439d2ef6a
SHA1

206a16a8cd984bc227baf921cc8d3da6032e6a4f
SHA256

1e6a72c58db5d7224f81cd51b0e2b591b3469c838d2e1bc64d06d64a666657fd
SHA512

806cd232681dcf54f46e3012ec85133417263a590640faada18cf38162eacd6b729d0dc7a254a7378d1820d3198227ebda739191f4c0ce0a17e64b3c23b27ba2
SSDEEP

384:tqz/sIUBSzj5mMEEpi0D04eEMls/11AUfoUHadPw3+4CFYw5jICfyQY:1M5mME00xEbrl6Bq+409I9QY

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000900000002436c-104.dat	disable_win_def

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AntiRansom-zeRDiqjp.ps1\" -HiddenRun"	powershell.exe

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2580	wevtutil.exe
768	wevtutil.exe
5928	wevtutil.exe
5828	Process not Found
692	wevtutil.exe
2916	wevtutil.exe
5472	wevtutil.exe
5356	wevtutil.exe
4284	Process not Found
2148	Process not Found
5552	Process not Found
2428	wevtutil.exe
5668	wevtutil.exe
856	wevtutil.exe
2992	Process not Found
2496	Process not Found
5860	Process not Found
5524	wevtutil.exe
3944	wevtutil.exe
1080	Process not Found
4372	Process not Found
4308	wevtutil.exe
5772	Process not Found
4312	Process not Found
4476	Process not Found
536	wevtutil.exe
4628	wevtutil.exe
436	Process not Found
3804	Process not Found
5836	Process not Found
1844	wevtutil.exe
1372	wevtutil.exe
4476	Process not Found
4700	wevtutil.exe
1552	wevtutil.exe
4800	Process not Found
2032	Process not Found
5324	wevtutil.exe
4388	wevtutil.exe
5508	wevtutil.exe
5044	Process not Found
4768	wevtutil.exe
1576	wevtutil.exe
5328	wevtutil.exe
1800	Process not Found
6128	Process not Found
2580	Process not Found
624	Process not Found
1716	Process not Found
384	wevtutil.exe
3524	wevtutil.exe
2604	wevtutil.exe
5872	wevtutil.exe
540	Process not Found
740	Process not Found
1336	Process not Found
4616	wevtutil.exe
5484	wevtutil.exe
3472	Process not Found
2512	Process not Found
5056	wevtutil.exe
5016	wevtutil.exe
768	Process not Found
948	Process not Found

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Blocklisted process makes network request 1 IoCs

flow	pid	Process
36	3304	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3304	powershell.exe
4776	Process not Found
4708	Process not Found
4248	Process not Found
1668	Process not Found
3752	Process not Found

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdateCheck = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AntiRansom-zeRDiqjp.ps1\" -HiddenRun"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "powershell -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Verdacrypt#232.ps1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UserInitHelper = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AntiRansom-zeRDiqjp.ps1\" -HiddenRun"	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2224	Process not Found
3316	Process not Found

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1632	wevtutil.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\AntiRansom-zeRDiqjp.ps1	powershell.exe
File opened for modification	C:\Windows\System32\AntiRansom-zeRDiqjp.ps1	powershell.exe
File opened for modification	C:\Windows\System32\config\systemprofile:Jakatatales.ps1	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5744	Process not Found

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	wevtutil.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2496	Process not Found

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}	powershell.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	powershell.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
4776	Process not Found
4776	Process not Found
4776	Process not Found
4708	Process not Found
4708	Process not Found
4248	Process not Found
4248	Process not Found
4708	Process not Found
4248	Process not Found
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
1668	Process not Found
1668	Process not Found
1668	Process not Found
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3304	powershell.exe
3752	Process not Found
3752	Process not Found
3752	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeSecurityPrivilege	4524	wevtutil.exe
Token: SeBackupPrivilege	4524	wevtutil.exe
Token: SeSecurityPrivilege	1684	wevtutil.exe
Token: SeBackupPrivilege	1684	wevtutil.exe
Token: SeSecurityPrivilege	4512	wevtutil.exe
Token: SeBackupPrivilege	4512	wevtutil.exe
Token: SeSecurityPrivilege	6088	wevtutil.exe
Token: SeBackupPrivilege	6088	wevtutil.exe
Token: SeSecurityPrivilege	5232	wevtutil.exe
Token: SeBackupPrivilege	5232	wevtutil.exe
Token: SeSecurityPrivilege	1384	wevtutil.exe
Token: SeBackupPrivilege	1384	wevtutil.exe
Token: SeSecurityPrivilege	5256	wevtutil.exe
Token: SeBackupPrivilege	5256	wevtutil.exe
Token: SeSecurityPrivilege	5448	wevtutil.exe
Token: SeBackupPrivilege	5448	wevtutil.exe
Token: SeSecurityPrivilege	4648	wevtutil.exe
Token: SeBackupPrivilege	4648	wevtutil.exe
Token: SeSecurityPrivilege	4700	wevtutil.exe
Token: SeBackupPrivilege	4700	wevtutil.exe
Token: SeSecurityPrivilege	4728	wevtutil.exe
Token: SeBackupPrivilege	4728	wevtutil.exe
Token: SeSecurityPrivilege	4716	wevtutil.exe
Token: SeBackupPrivilege	4716	wevtutil.exe
Token: SeSecurityPrivilege	4628	wevtutil.exe
Token: SeBackupPrivilege	4628	wevtutil.exe
Token: SeSecurityPrivilege	4644	wevtutil.exe
Token: SeBackupPrivilege	4644	wevtutil.exe
Token: SeSecurityPrivilege	4740	wevtutil.exe
Token: SeBackupPrivilege	4740	wevtutil.exe
Token: SeSecurityPrivilege	4640	wevtutil.exe
Token: SeBackupPrivilege	4640	wevtutil.exe
Token: SeSecurityPrivilege	2528	wevtutil.exe
Token: SeBackupPrivilege	2528	wevtutil.exe
Token: SeSecurityPrivilege	3416	wevtutil.exe
Token: SeBackupPrivilege	3416	wevtutil.exe
Token: SeSecurityPrivilege	4840	wevtutil.exe
Token: SeBackupPrivilege	4840	wevtutil.exe
Token: SeSecurityPrivilege	4844	wevtutil.exe
Token: SeBackupPrivilege	4844	wevtutil.exe
Token: SeSecurityPrivilege	1164	wevtutil.exe
Token: SeBackupPrivilege	1164	wevtutil.exe
Token: SeSecurityPrivilege	5824	wevtutil.exe
Token: SeBackupPrivilege	5824	wevtutil.exe
Token: SeSecurityPrivilege	3160	wevtutil.exe
Token: SeBackupPrivilege	3160	wevtutil.exe
Token: SeSecurityPrivilege	5516	wevtutil.exe
Token: SeBackupPrivilege	5516	wevtutil.exe
Token: SeSecurityPrivilege	3516	wevtutil.exe
Token: SeBackupPrivilege	3516	wevtutil.exe
Token: SeSecurityPrivilege	3336	wevtutil.exe
Token: SeBackupPrivilege	3336	wevtutil.exe
Token: SeSecurityPrivilege	5468	wevtutil.exe
Token: SeBackupPrivilege	5468	wevtutil.exe
Token: SeSecurityPrivilege	4584	wevtutil.exe
Token: SeBackupPrivilege	4584	wevtutil.exe
Token: SeSecurityPrivilege	4592	wevtutil.exe
Token: SeBackupPrivilege	4592	wevtutil.exe
Token: SeSecurityPrivilege	5328	wevtutil.exe
Token: SeBackupPrivilege	5328	wevtutil.exe
Token: SeSecurityPrivilege	2620	wevtutil.exe
Token: SeBackupPrivilege	2620	wevtutil.exe
Token: SeSecurityPrivilege	5512	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 4240	3304	powershell.exe	89
PID 3304 wrote to memory of 4240	3304	powershell.exe	89
PID 4240 wrote to memory of 4348	4240	csc.exe	91
PID 4240 wrote to memory of 4348	4240	csc.exe	91
PID 3304 wrote to memory of 4772	3304	powershell.exe	94
PID 3304 wrote to memory of 4772	3304	powershell.exe	94
PID 3304 wrote to memory of 4524	3304	powershell.exe	96
PID 3304 wrote to memory of 4524	3304	powershell.exe	96
PID 3304 wrote to memory of 1684	3304	powershell.exe	97
PID 3304 wrote to memory of 1684	3304	powershell.exe	97
PID 3304 wrote to memory of 4512	3304	powershell.exe	98
PID 3304 wrote to memory of 4512	3304	powershell.exe	98
PID 3304 wrote to memory of 6088	3304	powershell.exe	99
PID 3304 wrote to memory of 6088	3304	powershell.exe	99
PID 3304 wrote to memory of 5232	3304	powershell.exe	100
PID 3304 wrote to memory of 5232	3304	powershell.exe	100
PID 3304 wrote to memory of 1384	3304	powershell.exe	101
PID 3304 wrote to memory of 1384	3304	powershell.exe	101
PID 3304 wrote to memory of 5256	3304	powershell.exe	102
PID 3304 wrote to memory of 5256	3304	powershell.exe	102
PID 3304 wrote to memory of 5448	3304	powershell.exe	103
PID 3304 wrote to memory of 5448	3304	powershell.exe	103
PID 3304 wrote to memory of 4648	3304	powershell.exe	104
PID 3304 wrote to memory of 4648	3304	powershell.exe	104
PID 3304 wrote to memory of 4700	3304	powershell.exe	105
PID 3304 wrote to memory of 4700	3304	powershell.exe	105
PID 3304 wrote to memory of 4728	3304	powershell.exe	106
PID 3304 wrote to memory of 4728	3304	powershell.exe	106
PID 3304 wrote to memory of 4716	3304	powershell.exe	107
PID 3304 wrote to memory of 4716	3304	powershell.exe	107
PID 3304 wrote to memory of 4628	3304	powershell.exe	108
PID 3304 wrote to memory of 4628	3304	powershell.exe	108
PID 3304 wrote to memory of 4644	3304	powershell.exe	109
PID 3304 wrote to memory of 4644	3304	powershell.exe	109
PID 3304 wrote to memory of 4740	3304	powershell.exe	110
PID 3304 wrote to memory of 4740	3304	powershell.exe	110
PID 3304 wrote to memory of 4640	3304	powershell.exe	111
PID 3304 wrote to memory of 4640	3304	powershell.exe	111
PID 3304 wrote to memory of 2528	3304	powershell.exe	112
PID 3304 wrote to memory of 2528	3304	powershell.exe	112
PID 3304 wrote to memory of 3416	3304	powershell.exe	113
PID 3304 wrote to memory of 3416	3304	powershell.exe	113
PID 3304 wrote to memory of 4840	3304	powershell.exe	114
PID 3304 wrote to memory of 4840	3304	powershell.exe	114
PID 3304 wrote to memory of 4844	3304	powershell.exe	115
PID 3304 wrote to memory of 4844	3304	powershell.exe	115
PID 3304 wrote to memory of 1164	3304	powershell.exe	116
PID 3304 wrote to memory of 1164	3304	powershell.exe	116
PID 3304 wrote to memory of 5824	3304	powershell.exe	117
PID 3304 wrote to memory of 5824	3304	powershell.exe	117
PID 3304 wrote to memory of 3160	3304	powershell.exe	118
PID 3304 wrote to memory of 3160	3304	powershell.exe	118
PID 3304 wrote to memory of 5516	3304	powershell.exe	119
PID 3304 wrote to memory of 5516	3304	powershell.exe	119
PID 3304 wrote to memory of 3516	3304	powershell.exe	120
PID 3304 wrote to memory of 3516	3304	powershell.exe	120
PID 3304 wrote to memory of 3336	3304	powershell.exe	121
PID 3304 wrote to memory of 3336	3304	powershell.exe	121
PID 3304 wrote to memory of 5468	3304	powershell.exe	122
PID 3304 wrote to memory of 5468	3304	powershell.exe	122
PID 3304 wrote to memory of 4584	3304	powershell.exe	123
PID 3304 wrote to memory of 4584	3304	powershell.exe	123
PID 3304 wrote to memory of 4592	3304	powershell.exe	124
PID 3304 wrote to memory of 4592	3304	powershell.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Verdacrypt#232.ps1
1⤵
- Modifies WinLogon for persistence
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cnqi2ef4\cnqi2ef4.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5498.tmp" "c:\Users\Admin\AppData\Local\Temp\cnqi2ef4\CSCFB6581DA84D04DCBB6BA2C9C2DA9FDEB.TMP"
    3⤵
    PID:4348
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\SomeTask
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" el
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl AMSI/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl AirSpaceChannel
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Application
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl DirectShowFilterGraph
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl DirectShowPluginControl
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5256
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Els_Hyphenation/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl EndpointMapper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl FirstUXPerf-Analytic
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl ForwardedEvents
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "General Logging"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl HardwareEvents
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl IHM_DebugChannel
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4644
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS-GPIO/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS-I2C/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-GPIO2/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-GPIO2/Performance
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-I2C/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-I2C/Performance
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4844
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Internet Explorer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Key Management Service"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationDeviceMFT
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationDeviceProxy
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationFrameServer
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MedaFoundationVideoProc
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MedaFoundationVideoProcD3D
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationAsyncWrapper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationContentProtection
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationDS
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationDeviceProxy
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationMP4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationMediaEngine
  2⤵
  PID:624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPerformance
  2⤵
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPerformanceCore
  2⤵
  PID:5724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPipeline
  2⤵
  PID:5048
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPlatform
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationSrcPrefetch
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client-Streamingux/Debug
  2⤵
  PID:2320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Admin
  2⤵
  PID:6016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Debug
  2⤵
  PID:396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Operational
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-AppV-Client/Virtual Applications"
  2⤵
  PID:2824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-SharedPerformance/Analytic
  2⤵
  PID:3380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Admin
  2⤵
  PID:1992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Debug
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Diagnostic
  2⤵
  PID:1160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-IE/Diagnostic
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-IEFRAME/Diagnostic
  2⤵
  PID:2472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-JSDumpHeap/Diagnostic
  2⤵
  PID:6116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-OneCore-Setup/Analytic
  2⤵
  PID:3112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-PerfTrack-IEFRAME/Diagnostic
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-PerfTrack-MSHTML/Diagnostic
  2⤵
  PID:2672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Admin/Debug"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
  2⤵
  - Clears Windows event logs
  PID:384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
  2⤵
  PID:1120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Debug"
  2⤵
  PID:5420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Operational"
  2⤵
  PID:5520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-IPC/Operational"
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
  2⤵
  - Clears Windows event logs
  PID:5524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Analytic
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Operational
  2⤵
  PID:5472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ADSI/Debug
  2⤵
  PID:720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ASN1/Operational
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ATAPort/General
  2⤵
  PID:5640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ATAPort/SATA-LPM
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ActionQueue/Analytic
  2⤵
  PID:5404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-All-User-Install-Agent/Admin
  2⤵
  PID:2380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Debug
  2⤵
  PID:4360
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Operational
  2⤵
  PID:3396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Admin
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/ApplicationTracing
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Diagnostic
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Internal
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppID/Operational
  2⤵
  PID:1852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/EXE and DLL"
  2⤵
  - Clears Windows event logs
  PID:5324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/MSI and Script"
  2⤵
  PID:5204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
  2⤵
  PID:1448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Admin
  2⤵
  PID:4024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Analytic
  2⤵
  - Clears Windows event logs
  PID:768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Debug
  2⤵
  PID:884
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Diagnostics
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-State/Debug
  2⤵
  PID:5744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-State/Diagnostic
  2⤵
  PID:2148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Admin
  2⤵
  PID:692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Debug
  2⤵
  PID:5828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Operational
  2⤵
  PID:5504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppSruProv
  2⤵
  PID:1380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Diagnostic
  2⤵
  PID:5164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Operational
  2⤵
  PID:368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Debug
  2⤵
  PID:5292
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Diagnostic
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Operational
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Restricted
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Analytic
  2⤵
  PID:2872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Operational
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Admin"
  2⤵
  PID:5336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Analytic"
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Debug"
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Operational"
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
  2⤵
  PID:5560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic
  2⤵
  PID:5044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace
  2⤵
  PID:8
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
  2⤵
  PID:2648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Inventory
  2⤵
  PID:5116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Telemetry
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Steps-Recorder
  2⤵
  PID:4312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Debug
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Operational
  2⤵
  PID:5408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Performance
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Admin
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Operational
  2⤵
  PID:3436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Admin
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Operational
  2⤵
  PID:5532
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AsynchronousCausality/Causality
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/CaptureMonitor
  2⤵
  PID:2804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/GlitchDetection
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Informational
  2⤵
  PID:6088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Operational
  2⤵
  PID:5232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Performance
  2⤵
  PID:1384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/PlaybackManager
  2⤵
  PID:5256
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audit/Analytic
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Authentication User Interface/Operational"
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUser-Client
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
  2⤵
  PID:4080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
  2⤵
  PID:4664
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AxInstallService/Log
  2⤵
  PID:4668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHPORT/HCI
  2⤵
  PID:3068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHPORT/L2CAP
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHUSB/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:2580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHUSB/Performance
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic
  2⤵
  PID:3632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Operational
  2⤵
  PID:1436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
  2⤵
  PID:1180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Backup
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
  2⤵
  PID:5932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Battery/Diagnostic
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Analytic
  2⤵
  PID:972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Operational
  2⤵
  PID:2312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
  2⤵
  PID:1668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
  2⤵
  PID:1656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-Driver-Performance/Operational
  2⤵
  PID:2828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Management"
  2⤵
  PID:1064
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Operational"
  2⤵
  PID:396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker/Tracing
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Analytic
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Operational
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational
  2⤵
  PID:3472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Bthmini/Operational
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-MTPEnum/Operational
  2⤵
  PID:1160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Policy/Operational
  2⤵
  PID:1968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCache/Operational
  2⤵
  PID:5348
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheEventProvider/Diagnostic
  2⤵
  PID:4268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheMonitoring/Analytic
  2⤵
  PID:712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Analytic
  2⤵
  PID:5132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Operational
  2⤵
  PID:4148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
  2⤵
  PID:6028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CAPI2/Operational
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CDROM/Operational
  2⤵
  PID:1720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/Analytic
  2⤵
  PID:3688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ApartmentInitialize
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ApartmentUninitialize
  2⤵
  PID:5852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/Call
  2⤵
  PID:5524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/CreateInstance
  2⤵
  PID:5220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ExtensionCatalog
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/FreeUnusedLibrary
  2⤵
  PID:5472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/RundownInstrumentation
  2⤵
  PID:720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/Activations
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/MessageProcessing
  2⤵
  PID:5640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/Tracing
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertPoleEng/Operational
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
  2⤵
  PID:3456
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
  2⤵
  PID:5684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
  2⤵
  PID:1516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Cleanmgr/Diagnostic
  2⤵
  PID:5676
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ClearTypeTextTuner/Diagnostic
  2⤵
  PID:5936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Debug
  2⤵
  PID:4672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Operational
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CmiSetup/Analytic
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Operational
  2⤵
  PID:3648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Verbose
  2⤵
  PID:4784
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ComDlg32/Analytic
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ComDlg32/Debug
  2⤵
  PID:5268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Analytic
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Operational
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Debug
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Operational
  2⤵
  PID:5912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Debug
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Operational
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Debug
  2⤵
  PID:3464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Operational
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Diagnostic
  2⤵
  PID:5364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Operational
  2⤵
  PID:5128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Tracing
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug
  2⤵
  PID:804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreWindow/Analytic
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreWindow/Debug
  2⤵
  PID:4016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Client/Operational
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Server/Operational
  2⤵
  PID:5388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crashdump/Operational
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CredUI/Diagnostic
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-BCRYPT/Analytic
  2⤵
  PID:1832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-CNG/Analytic
  2⤵
  PID:2564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
  2⤵
  PID:2364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Debug
  2⤵
  PID:5772
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Operational
  2⤵
  PID:5732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DSSEnh/Analytic
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-NCrypt/Operational
  2⤵
  PID:3640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-RNG/Analytic
  2⤵
  PID:3440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-RSAEnh/Analytic
  2⤵
  PID:6040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-D3D10Level9/Analytic
  2⤵
  PID:4312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-D3D10Level9/PerfTiming
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Analytic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Operational
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAMM/Diagnostic
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DCLocator/Debug
  2⤵
  PID:5816
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DDisplay/Analytic
  2⤵
  PID:1536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DDisplay/Logging
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DLNA-Namespace/Analytic
  2⤵
  PID:2036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DNS-Client/Operational
  2⤵
  PID:2196
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Admin
  2⤵
  PID:6000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Analytic
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Debug
  2⤵
  PID:2204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Operational
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DUI/Diagnostic
  2⤵
  PID:5860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DUSER/Diagnostic
  2⤵
  PID:2412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXGI/Analytic
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXGI/Logging
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXP/Analytic
  2⤵
  PID:4720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Data-Pdf/Debug
  2⤵
  PID:464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/Admin
  2⤵
  - Clears Windows event logs
  PID:4616
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/CrashRecovery
  2⤵
  PID:4652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Analytic
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Debug
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Operational
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Diagnostic
  2⤵
  PID:5628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Operational
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Performance
  2⤵
  PID:4940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Scrubbing
  2⤵
  PID:4584
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Defrag-Core/Debug
  2⤵
  - Clears Windows event logs
  PID:2428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deplorch/Analytic
  2⤵
  PID:5924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DesktopActivityModerator/Diagnostic
  2⤵
  PID:2296
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceAssociationService/Performance
  2⤵
  PID:5976
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceConfidence/Analytic
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Operational
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Verbose
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
  2⤵
  PID:1648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug
  2⤵
  PID:2140
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational
  2⤵
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Admin
  2⤵
  PID:5296
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Analytic
  2⤵
  PID:3424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Debug
  2⤵
  PID:1040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Operational
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Analytic
  2⤵
  PID:6100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Operational
  2⤵
  PID:1716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUpdateAgent/Operational
  2⤵
  - Clears Windows event logs
  PID:3524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUx/Informational
  2⤵
  PID:1912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUx/Performance
  2⤵
  PID:5552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Devices-Background/Operational
  2⤵
  PID:2444
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Admin
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Operational
  2⤵
  PID:2672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Admin
  2⤵
  PID:384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Operational
  2⤵
  PID:4432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiagCpl/Debug
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic
  2⤵
  PID:5496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Analytic
  2⤵
  PID:5520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Debug
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Operational
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-MSDE/Debug
  2⤵
  PID:936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Analytic
  2⤵
  PID:1768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Debug
  2⤵
  PID:5472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Operational
  2⤵
  PID:740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Debug
  2⤵
  PID:5640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Operational
  2⤵
  PID:2380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Perfhost/Analytic
  2⤵
  PID:4360
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scheduled/Operational
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Admin
  2⤵
  PID:5676
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Analytic
  2⤵
  PID:2476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Debug
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Operational
  2⤵
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
  2⤵
  PID:544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-WDC/Analytic
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-WDI/Debug
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Debug
  2⤵
  PID:768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Operational
  2⤵
  PID:884
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic
  2⤵
  PID:6120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Diagnostic
  2⤵
  PID:5156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
  2⤵
  PID:5164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Operational
  2⤵
  PID:1640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D10/Analytic
  2⤵
  PID:3708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D10_1/Analytic
  2⤵
  - Clears Windows event logs
  PID:5668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/Analytic
  2⤵
  - Clears Windows event logs
  PID:5056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/Logging
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/PerfTiming
  2⤵
  PID:4316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/Analytic
  2⤵
  PID:220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/Logging
  2⤵
  PID:452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/PerfTiming
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D9/Analytic
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3DShaderCache/Default
  2⤵
  PID:316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectComposition/Diagnostic
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectManipulation/Diagnostic
  2⤵
  PID:4372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectShow-KernelSupport/Performance
  2⤵
  PID:1736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectSound/Debug
  2⤵
  PID:8
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Disk/Operational
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnostic/Operational
  2⤵
  - Clears Windows event logs
  PID:2604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticDataCollector/Operational
  2⤵
  PID:2384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticResolver/Operational
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/Analytic
  2⤵
  PID:3576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/ExternalAnalytic
  2⤵
  - Clears Windows event logs
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/InternalAnalytic
  2⤵
  PID:1212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Cli/Analytic
  2⤵
  PID:5176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Debug
  2⤵
  PID:3748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Operational
  2⤵
  PID:400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplaySwitch/Diagnostic
  2⤵
  PID:2236
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Documents/Performance
  2⤵
  PID:1684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dot3MM/Diagnostic
  2⤵
  PID:2004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DriverFrameworks-UserMode/Operational
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DucUpdateAgent/Operational
  2⤵
  PID:2588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-API/Diagnostic
  2⤵
  PID:668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Core/Diagnostic
  2⤵
  PID:5124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Dwm/Diagnostic
  2⤵
  PID:1284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Redir/Diagnostic
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Udwm/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:4768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Admin
  2⤵
  PID:2804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Operational
  2⤵
  PID:1336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Contention
  2⤵
  PID:3080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Diagnostic
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Performance
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Power
  2⤵
  PID:5232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxpTaskSyncProvider/Analytic
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Application-Learning/Admin
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-Regular/Admin
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-TCB/Admin
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EFS/Debug
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/IODiagnose
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/Operational
  2⤵
  PID:4628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Analytic
  2⤵
  PID:3760
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Debug
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Operational
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasChap/Operational
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasTls/Operational
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Sim/Operational
  2⤵
  PID:3632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Ttls/Operational
  2⤵
  PID:1180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EaseOfAccess/Diagnostic
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/EventLog
  2⤵
  PID:5284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/Trace
  2⤵
  PID:620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic
  2⤵
  PID:3244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Debug
  2⤵
  PID:1188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Operational
  2⤵
  - Clears Windows event logs
  PID:856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog-WMIProvider/Debug
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog/Analytic
  2⤵
  PID:1656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog/Debug
  2⤵
  PID:6016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Analytic
  2⤵
  PID:2568
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Debug
  2⤵
  PID:2068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Operational
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FailoverClustering-Client/Diagnostic
  2⤵
  PID:4804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Fault-Tolerant-Heap/Operational
  2⤵
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Analytic
  2⤵
  PID:1756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Operational
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Catalog/Analytic
  2⤵
  PID:1160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Catalog/Debug
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-ConfigManager/Analytic
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-ConfigManager/Debug
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/Analytic
  2⤵
  PID:2172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/Debug
  2⤵
  PID:712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/WHC
  2⤵
  PID:1544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/Analytic
  2⤵
  PID:5568
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/BackupLog
  2⤵
  PID:384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/Debug
  2⤵
  PID:4432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-EventListener/Analytic
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-EventListener/Debug
  2⤵
  PID:5496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Service/Analytic
  2⤵
  PID:5520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Service/Debug
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-UI-Events/Analytic
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-UI-Events/Debug
  2⤵
  PID:936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileInfoMinifilter/Operational
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Firewall-CPL/Diagnostic
  2⤵
  PID:4352
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Folder Redirection/Operational"
  2⤵
  PID:3920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Debug
  2⤵
  PID:1588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Operational
  2⤵
  PID:5964
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GPIO-ClassExtension/Analytic
  2⤵
  PID:1312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GenericRoaming/Admin
  2⤵
  PID:1768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GroupPolicy/Operational
  2⤵
  PID:5472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HAL/Debug
  2⤵
  PID:5404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenter/Debug
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenter/Performance
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenterCPL/Performance
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HelloForBusiness/Operational
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Help/Operational
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
  2⤵
  PID:2640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
  2⤵
  PID:5324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
  2⤵
  PID:5204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
  2⤵
  PID:5684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HomeGroup-ListenerService
  2⤵
  PID:1844
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Analytic
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Operational
  2⤵
  PID:4024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Log
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Trace
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
  2⤵
  - Clears Windows event logs
  PID:2916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Admin
  2⤵
  PID:5828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Analytic
  2⤵
  PID:3280
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Operational
  2⤵
  PID:4992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Admin
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Analytic
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IE-SmartScreen
  2⤵
  PID:2364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKE/Operational
  2⤵
  PID:1736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKEDBG/Debug
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-Broker/Analytic
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CandidateUI/Analytic
  2⤵
  PID:3640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CustomerFeedbackManager/Debug
  2⤵
  PID:772
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic
  2⤵
  PID:5360
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPAPI/Analytic
  2⤵
  PID:4312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPLMP/Analytic
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPPRED/Analytic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPSetting/Analytic
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPTIP/Analytic
  2⤵
  PID:3436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-KRAPI/Analytic
  2⤵
  PID:5816
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-KRTIP/Analytic
  2⤵
  PID:5532
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-OEDCompiler/Analytic
  2⤵
  PID:1536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TCCORE/Analytic
  2⤵
  PID:2264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TCTIP/Analytic
  2⤵
  PID:6064
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TIP/Analytic
  2⤵
  PID:1236
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPNAT/Diagnostic
  2⤵
  PID:4936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPSEC-SRV/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:5016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Debug
  2⤵
  PID:2688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Operational
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Analytic
  2⤵
  PID:6132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Operational
  2⤵
  PID:5372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic
  2⤵
  PID:6000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Input-HIDCLASS-Analytic
  2⤵
  PID:4292
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-InputSwitch/Diagnostic
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Debug
  2⤵
  PID:5232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Operational
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Trace
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KdsSvc/Operational
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kerberos/Operational
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Acpi/Diagnostic
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-AppCompat/General
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-AppCompat/Performance
  2⤵
  PID:4628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Analytic
  2⤵
  PID:3760
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Debug
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Operational
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Analytic
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Operational
  2⤵
  PID:5920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Disk/Analytic
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Admin
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Analytic
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-File/Analytic
  2⤵
  PID:4940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IO/Operational
  2⤵
  PID:5248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic
  2⤵
  PID:432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IoTrace/Diagnostic
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Analytic
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Operational
  2⤵
  PID:5284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Memory/Analytic
  2⤵
  PID:620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Network/Analytic
  2⤵
  PID:372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Pdc/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:5872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Pep/Diagnostic
  2⤵
  PID:2312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
  2⤵
  PID:1668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-PnP/Configuration
  2⤵
  PID:2320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
  2⤵
  PID:1648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
  2⤵
  PID:2140
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
  2⤵
  PID:396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
  2⤵
  PID:4008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Diagnostic
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
  2⤵
  PID:5636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Operational
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Prefetch/Diagnostic
  2⤵
  PID:6100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Process/Analytic
  2⤵
  PID:1716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Processor-Power/Diagnostic
  2⤵
  PID:1968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Registry/Analytic
  2⤵
  PID:5348
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Registry/Performance
  2⤵
  PID:3448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Debug
  2⤵
  PID:2444
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Diagnostic
  2⤵
  PID:6008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Operational
  2⤵
  PID:4348
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Analytic
  2⤵
  PID:4148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Operational
  2⤵
  PID:6028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Analytic
  2⤵
  PID:3596
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Debug
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Operational
  2⤵
  PID:3688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Errors
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Operational
  2⤵
  PID:5852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-XDV/Analytic
  2⤵
  PID:4504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Admin
  2⤵
  PID:4812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Operational
  2⤵
  PID:5048
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Performance
  2⤵
  PID:2072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Known Folders API Service"
  2⤵
  PID:5836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-L2NA/Diagnostic
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LDAP-Client/Debug
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Diagnostic
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Operational
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Performance
  2⤵
  PID:740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LUA-ConsentUI/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:5472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Analytic
  2⤵
  PID:5404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Debug
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Operational
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LimitsManagement/Diagnostic
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Analytic
  2⤵
  PID:2640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Operational
  2⤵
  PID:5324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic
  2⤵
  PID:5204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-CLNT/Diagnostic
  2⤵
  PID:5684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-DRV/Diagnostic
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-SRV/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:1844
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSFTEDIT/Diagnostic
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Admin
  2⤵
  PID:4024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Debug
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Diagnostic
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Admin
  2⤵
  PID:2916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Analytic
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Debug
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Operational
  2⤵
  PID:804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/DMC
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/DMR
  2⤵
  PID:368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/MDE
  2⤵
  PID:2396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter
  2⤵
  PID:744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader
  2⤵
  PID:316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/Transform
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-Performance/SARStreamResource
  2⤵
  PID:3588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-PlayAPI/Analytic
  2⤵
  PID:2648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MemoryDiagnostics-Results/Debug
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Minstore/Analytic
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Minstore/Debug
  2⤵
  - Clears Windows event logs
  PID:5356
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic
  2⤵
  PID:2384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic
  2⤵
  PID:1620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic
  2⤵
  PID:3576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic
  2⤵
  PID:1212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MobilityCenter/Performance
  2⤵
  PID:5176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin
  2⤵
  PID:3436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot
  2⤵
  PID:424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug
  2⤵
  PID:5100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService
  2⤵
  PID:628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mprddm/Operational
  2⤵
  PID:4916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Analytic
  2⤵
  PID:4540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Operational
  2⤵
  PID:5832
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDF-HelperClassDiscovery/Debug
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS-PacketCapture/Diagnostic
  2⤵
  PID:2976
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Diagnostic
  2⤵
  PID:3948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Operational
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NTLM/Operational
  2⤵
  PID:6132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NWiFi/Diagnostic
  2⤵
  PID:5372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Narrator/Diagnostic
  2⤵
  PID:6000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ncasvc/Operational
  2⤵
  PID:4292
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Diagnostic
  2⤵
  PID:6088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Operational
  2⤵
  PID:3988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NdisImPlatform/Operational
  2⤵
  PID:4676
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ndu/Diagnostic
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetShell/Performance
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-Connection-Broker
  2⤵
  PID:4720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-DataUsage/Analytic
  2⤵
  PID:4712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-Setup/Diagnostic
  2⤵
  PID:4660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-and-Sharing-Center/Diagnostic
  2⤵
  PID:4664
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkBridge/Diagnostic
  2⤵
  PID:4628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkLocationWizard/Operational
  2⤵
  PID:3760
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Diagnostic
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Operational
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvider/Operational
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Analytic
  2⤵
  PID:5920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Operational
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkSecurity/Debug
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkStatus/Analytic
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Networking-Correlation/Diagnostic
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Networking-RealTimeCommunication/Tracing
  2⤵
  - System Time Discovery
  PID:4940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Diagnostic
  2⤵
  PID:5248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Operational
  2⤵
  PID:432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Operational
  2⤵
  PID:5924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Performance
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/WHC
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLE/Clipboard-Performance
  2⤵
  PID:972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLEACC/Debug
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLEACC/Diagnostic
  2⤵
  PID:2316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-Core/Diagnostic
  2⤵
  PID:2828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Diagnostic
  2⤵
  PID:1064
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Operational
  2⤵
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic
  2⤵
  PID:5296
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OcpUpdateAgent/Operational
  2⤵
  PID:3424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Analytic
  2⤵
  PID:1040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Debug
  2⤵
  PID:3472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Operational
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/SyncLog
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneBackup/Debug
  2⤵
  PID:4828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Diagnostic
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Operational
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OobeLdr/Analytic
  2⤵
  PID:5552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OtpCredentialProvider/Operational
  2⤵
  PID:2172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PCI/Diagnostic
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Analytic
  2⤵
  PID:2672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Debug
  2⤵
  PID:5308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Operational
  2⤵
  PID:4388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ParentalControls/Operational
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Analytic
  2⤵
  PID:3752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Diagnostic
  2⤵
  PID:5352
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionRuntime/Operational
  2⤵
  PID:2960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionSensorDataService/Operational
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Analytic
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic
  2⤵
  PID:5944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Operational
  2⤵
  PID:1944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Analytic
  2⤵
  PID:6024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Operational
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Analytic
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Certification
  2⤵
  PID:1396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Diagnose
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Operational
  2⤵
  PID:5820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PhotoAcq/Analytic
  2⤵
  PID:5640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PlayToManager/Analytic
  2⤵
  PID:2380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Analytic
  2⤵
  PID:4128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Operational
  2⤵
  PID:5936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PortableDeviceStatusProvider/Analytic
  2⤵
  PID:4672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PortableDeviceSyncProvider/Analytic
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Power-Meter-Polling/Diagnostic
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerCfg/Diagnostic
  2⤵
  - Power Settings
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerCpl/Diagnostic
  2⤵
  PID:5324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic
  2⤵
  PID:5684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational
  2⤵
  PID:1844
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Admin
  2⤵
  PID:2636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Analytic
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Debug
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrimaryNetworkIcon/Performance
  2⤵
  PID:2916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintBRM/Admin
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService-USBMon/Debug
  2⤵
  PID:2352
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Admin
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Debug
  2⤵
  PID:920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Operational
  2⤵
  PID:452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Privacy-Auditing/Operational
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ProcessStateManager/Diagnostic
  2⤵
  PID:436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/Analytic
  2⤵
  PID:3512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot
  2⤵
  PID:2488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug
  2⤵
  PID:3588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Diagnostic
  2⤵
  PID:3640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Informational
  2⤵
  PID:636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Performance
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Developer/Debug
  2⤵
  PID:5408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-InProc/Debug
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Admin
  2⤵
  PID:4788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Debug
  2⤵
  PID:3748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Operational
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-QoS-Pacer/Diagnostic
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-QoS-qWAVE/Debug
  2⤵
  PID:1684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC-Proxy/Debug
  2⤵
  PID:2004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC/Debug
  2⤵
  PID:344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC/EEInfo
  2⤵
  PID:2588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Debug
  2⤵
  PID:668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Operational
  2⤵
  PID:5896
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RadioManager/Analytic
  2⤵
  PID:5536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Debug
  2⤵
  PID:2196
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Operational
  2⤵
  PID:2804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReFS/Operational
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Analytic
  2⤵
  PID:3700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Operational
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Analytic
  2⤵
  PID:6088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Operational
  2⤵
  PID:2076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Regsvr32/Operational
  2⤵
  PID:2412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Admin
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Operational
  2⤵
  PID:4716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Tracing
  2⤵
  PID:3608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin
  2⤵
  PID:4660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug
  2⤵
  PID:4664
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
  2⤵
  - Clears Windows event logs
  PID:4628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin
  2⤵
  PID:3760
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational
  2⤵
  PID:4636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Diagnostic
  2⤵
  PID:5920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Operational
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ResetEng-Trace/Diagnostic
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Detector/Operational
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ResourcePublication/Tracing
  2⤵
  PID:4940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RestartManager/Operational
  2⤵
  PID:2620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Admin
  2⤵
  PID:2428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Operational
  2⤵
  PID:5512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Graphics/Analytic
  2⤵
  PID:5288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing
  2⤵
  PID:1752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Networking/Tracing
  2⤵
  PID:6124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Web-Http/Tracing
  2⤵
  PID:5376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-WebAPI/Tracing
  2⤵
  PID:624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource
  2⤵
  PID:620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine
  2⤵
  PID:5976
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime/CreateInstance
  2⤵
  PID:860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime/Error
  2⤵
  PID:1656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Analytic
  2⤵
  PID:5756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/HelperClassDiagnostic
  2⤵
  PID:3380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/ObjectStateDiagnostic
  2⤵
  PID:1992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Operational
  2⤵
  - Clears Windows event logs
  PID:1576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Admin
  2⤵
  PID:5136
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Debug
  2⤵
  PID:1040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Netmon
  2⤵
  PID:3960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Analytic
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Audit
  2⤵
  PID:1716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Connectivity
  2⤵
  PID:2472
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Diagnostic
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Operational
  2⤵
  PID:3112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Performance
  2⤵
  PID:712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Security
  2⤵
  PID:5132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Admin
  2⤵
  PID:5632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Informational
  2⤵
  PID:1120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SPB-ClassExtension/Analytic
  2⤵
  PID:2496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SPB-HIDI2C/Analytic
  2⤵
  - Clears Windows event logs
  PID:4388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Schannel-Events/Perf
  2⤵
  PID:1492
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdbus/Analytic
  2⤵
  PID:3752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdbus/Debug
  2⤵
  PID:5352
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdstor/Analytic
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Search-Core/Diagnostic
  2⤵
  PID:2960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Search-ProtocolHandlers/Diagnostic
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Diagnostic
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Operational
  2⤵
  PID:5944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecureAssessment/Operational
  2⤵
  PID:1944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Adminless/Operational
  2⤵
  PID:6024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Operational
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational
  2⤵
  PID:4984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityListener/Operational
  2⤵
  PID:3480
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityStore/Performance
  2⤵
  PID:5508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational
  2⤵
  PID:4204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/KernelMode
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/UserMode
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Netlogon/Operational
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GC/Analytic
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational
  2⤵
  PID:3840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX/Analytic
  2⤵
  PID:3396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP/Perf
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-UserConsentVerifier/Audit
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Vault/Performance
  2⤵
  PID:2704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Admin
  2⤵
  PID:5272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Operational
  2⤵
  PID:1000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Perf
  2⤵
  PID:5912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SendTo/Diagnostic
  2⤵
  PID:6120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sens/Debug
  2⤵
  PID:1704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sensors/Debug
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sensors/Performance
  2⤵
  PID:5668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Serial-ClassExtension-V2/Analytic
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Serial-ClassExtension/Analytic
  2⤵
  PID:2352
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ServiceReportingApi/Debug
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Services-Svchost/Diagnostic
  2⤵
  PID:920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Services/Diagnostic
  2⤵
  PID:452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Servicing/Debug
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Debug
  2⤵
  PID:436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Operational
  2⤵
  PID:3512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Analytic
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Debug
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Operational
  2⤵
  PID:2488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Analytic
  2⤵
  PID:3588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Debug
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Operational
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/VerboseDebug
  2⤵
  PID:3348
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Setup/Analytic
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupCl/Analytic
  2⤵
  PID:4568
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupPlatform/Analytic
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupQueue/Analytic
  2⤵
  PID:5576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupUGC/Analytic
  2⤵
  PID:400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic
  2⤵
  PID:2236
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AppWizCpl/Diagnostic
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:5484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Common/Diagnostic
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic
  2⤵
  PID:4612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic
  2⤵
  PID:4596
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic
  2⤵
  PID:5124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic
  2⤵
  PID:2036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/ActionCenter
  2⤵
  PID:1028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/AppDefaults
  2⤵
  PID:1336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Diagnostic
  2⤵
  PID:2900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/LogonTasksChannel
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Operational
  2⤵
  PID:5860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-DefaultPrograms/Diagnostic
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-LockScreenContent/Diagnostic
  2⤵
  PID:5232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-OpenWith/Diagnostic
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Shwebsvc
  2⤵
  PID:5988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ZipFolder/Diagnostic
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational
  2⤵
  PID:5332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shsvcs/Diagnostic
  2⤵
  PID:4080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SleepStudy/Diagnostic
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-Audit/Authentication
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-DeviceEnum/Operational
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin
  2⤵
  PID:2580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational
  2⤵
  PID:5468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartScreen/Debug
  2⤵
  PID:3944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Audit
  2⤵
  PID:1412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Connectivity
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Diagnostic
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Security
  2⤵
  PID:4592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Speech-UserExperience/Diagnostic
  2⤵
  PID:5328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Spell-Checking/Analytic
  2⤵
  PID:1180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SpellChecker/Analytic
  2⤵
  PID:4896
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Spellchecking-Host/Analytic
  2⤵
  PID:1400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SruMon/Diagnostic
  2⤵
  PID:2644
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SrumTelemetry
  2⤵
  PID:1676
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Debug
  2⤵
  PID:1140
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Diagnostic
  2⤵
  PID:1884
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Operational
  2⤵
  PID:2988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Restricted
  2⤵
  PID:5284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorDiag/Operational
  2⤵
  PID:3880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorPort/Operational
  2⤵
  PID:3244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Admin
  2⤵
  PID:1188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Analytic
  2⤵
  PID:856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Debug
  2⤵
  - Clears Windows event logs
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Diagnose
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Operational
  2⤵
  PID:6016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Admin
  2⤵
  PID:2568
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Analytic
  2⤵
  PID:2068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Debug
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Diagnose
  2⤵
  PID:4804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Operational
  2⤵
  PID:3340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Admin
  2⤵
  PID:864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Analytic
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Debug
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Diagnose
  2⤵
  PID:4828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Operational
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Admin
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Analytic
  2⤵
  PID:4268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Debug
  2⤵
  PID:5552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Diagnose
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Health
  2⤵
  PID:2672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Operational
  2⤵
  PID:5308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering-IoHeat/Heat
  2⤵
  PID:6028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering/Admin
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Debug
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Operational
  2⤵
  PID:3688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSettings/Diagnostic
  2⤵
  PID:6128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Diagnostic
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Operational
  2⤵
  PID:5852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Performance
  2⤵
  PID:4504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-ManagementAgent/WHC
  2⤵
  PID:4812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic
  2⤵
  PID:5048
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Operational
  2⤵
  PID:3920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Store/Operational
  2⤵
  PID:5836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storsvc/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:1552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Subsys-Csr/Operational
  2⤵
  PID:3044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Subsys-SMSS/Operational
  2⤵
  PID:1396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/Main
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/PfApLog
  2⤵
  PID:4984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/StoreLog
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysmon/Operational
  2⤵
  PID:3480
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysprep/Analytic
  2⤵
  - Clears Windows event logs
  PID:5508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-System-Profile-HardwareId/Diagnostic
  2⤵
  PID:4204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsHandlers/Debug
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Debug
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Diagnostic
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Operational
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Diagnostic
  2⤵
  PID:3840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Operational
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msctf/Debug
  2⤵
  PID:3396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msctf/Diagnostic
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msutb/Debug
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msutb/Diagnostic
  2⤵
  PID:2704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TTS/Diagnostic
  2⤵
  PID:5272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinAPI/Diagnostic
  2⤵
  PID:1000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Diagnostic
  2⤵
  PID:5912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Operational
  2⤵
  PID:6120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Analytic
  2⤵
  PID:1704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Operational
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZUtil/Operational
  2⤵
  PID:5668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Debug
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Diagnostic
  2⤵
  PID:2352
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Maintenance
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Operational
  2⤵
  PID:920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskbarCPL/Diagnostic
  2⤵
  PID:452
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic
  2⤵
  PID:436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug
  2⤵
  PID:3512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Admin
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Debug
  2⤵
  PID:6040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-MediaRedirection/Analytic
  2⤵
  PID:3640
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Admin
  2⤵
  PID:636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Analytic
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Debug
  2⤵
  PID:5408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Operational
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Admin
  2⤵
  PID:4788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Analytic
  2⤵
  PID:3748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Debug
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Operational
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Analytic
  2⤵
  PID:1684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Debug
  2⤵
  PID:3924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Operational
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture
  2⤵
  PID:2588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback
  2⤵
  PID:4612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
  2⤵
  PID:5124
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug
  2⤵
  PID:2036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin
  2⤵
  PID:1028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic
  2⤵
  PID:1336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug
  2⤵
  PID:2900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Tethering-Manager/Analytic
  2⤵
  PID:5860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Tethering-Station/Analytic
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ThemeCPL/Diagnostic
  2⤵
  PID:5232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ThemeUI/Diagnostic
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Threat-Intelligence/Analytic
  2⤵
  PID:5988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service/Operational
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Admin
  2⤵
  PID:5332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Operational
  2⤵
  PID:4080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TunnelDriver
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC-FileVirtualization/Operational
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC/Operational
  2⤵
  PID:3760
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UI-Shell/Diagnostic
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAnimation/Diagnostic
  2⤵
  PID:5468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Debug
  2⤵
  - Clears Windows event logs
  PID:3944
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Diagnostic
  2⤵
  PID:1412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Perf
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIRibbon/Diagnostic
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-MAUSBHOST-Analytic
  2⤵
  PID:4592
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-UCX-Analytic
  2⤵
  - Clears Windows event logs
  PID:5328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBHUB/Diagnostic
  2⤵
  PID:1180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBHUB3-Analytic
  2⤵
  PID:4896
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBPORT/Diagnostic
  2⤵
  PID:1400
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBXHCI-Analytic
  2⤵
  PID:2644
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic
  2⤵
  PID:1676
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UniversalTelemetryClient/Operational
  2⤵
  PID:1140
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
  2⤵
  PID:1884
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
  2⤵
  PID:2988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Diagnostic"
  2⤵
  PID:5284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Operational"
  2⤵
  PID:3880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Admin"
  2⤵
  PID:3244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Debug"
  2⤵
  PID:1188
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Diagnostic"
  2⤵
  PID:856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Operational"
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Analytic
  2⤵
  PID:1656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Operational
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserAccountControl/Diagnostic
  2⤵
  PID:2568
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserModePowerService/Diagnostic
  2⤵
  PID:2068
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/ActionCenter
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceInstall
  2⤵
  PID:4804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceMetadata/Debug
  2⤵
  PID:3340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/Performance
  2⤵
  PID:864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/SchedulerOperations
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UxInit/Diagnostic
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UxTheme/Diagnostic
  2⤵
  PID:4828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VAN/Diagnostic
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VDRVROOT/Operational
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Analytic
  2⤵
  PID:712
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Operational
  2⤵
  PID:4268
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VIRTDISK-Analytic
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN-Client/Operational
  2⤵
  PID:2672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN/Operational
  2⤵
  PID:5308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VWiFi/Diagnostic
  2⤵
  PID:6028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Admin
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Operational
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Volume/Diagnostic
  2⤵
  PID:3688
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeControl/Performance
  2⤵
  PID:6128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Analytic
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Operational
  2⤵
  PID:5852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WABSyncProvider/Analytic
  2⤵
  PID:4504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WCN-Config-Registrar/Diagnostic
  2⤵
  PID:4812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WCNWiz/Analytic
  2⤵
  PID:5048
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WEPHOSTSVC/Operational
  2⤵
  PID:3920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WER-PayloadHealth/Operational
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Analytic
  2⤵
  PID:5836
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Operational
  2⤵
  - Clears Windows event logs
  PID:5928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-AutoConfig/Operational
  2⤵
  PID:2696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-Autoconfig/Diagnostic
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-Driver/Analytic
  2⤵
  PID:2020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-MediaManager/Diagnostic
  2⤵
  PID:5892
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLANConnectionFlow/Diagnostic
  2⤵
  PID:4284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Debug
  2⤵
  PID:2380
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Operational
  2⤵
  PID:4128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Trace
  2⤵
  PID:2476
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPDMCUI/Diagnostic
  2⤵
  PID:4672
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Diagnostic
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Operational
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSSUI/Diagnostic
  2⤵
  PID:5324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-API/Analytic
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Analytic
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Operational
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Analytic
  2⤵
  PID:1844
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Operational
  2⤵
  PID:2636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPBT/Analytic
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Analytic
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Operational
  2⤵
  PID:5812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPIP/Analytic
  2⤵
  PID:2916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPUS/Analytic
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WSC-SRV/Diagnostic
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WUSA/Debug
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WWAN-CFE/Diagnostic
  2⤵
  PID:5828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cbf7cc0d06a793e1a126e0317b075c1d

SHA1
ef887e58a1a4a61776c79fd56acdf85a91e94e4e

SHA256
06e90d65a0f76b00fef041aa8f70193bf2e0300d69dee11464fad7f9a9b406fc

SHA512
0335b8d53b0a52042ab16500e6d4af9bc0cbc9b475da5b5e22480fb5445edf5a1ffccf5fb4d8bd0390fad695d3fa737bc840711fbfbb746ae183be4ec729dfe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1t2mfvf5\1t2mfvf5.dll

Filesize
3KB

MD5
4736fad88e6647ed078b568855e5baf7

SHA1
ea107fa493caf12b632a9325a13863f52c6a4b06

SHA256
9b5cecc8702e222746f97c4f2e9405f2497f8bb6bb05618e34a2a145b5a69b09

SHA512
b0b693edef0564359aa32353fe05ae1f09b315e0761d0edfa81e9c457bcf7a2aa9095446c45333b596c1a5366612b7ae80dcfbd1e39ceae6f68f00274473065c

Download Submit
C:\Users\Admin\AppData\Local\Temp\50bdpuix\50bdpuix.dll

Filesize
3KB

MD5
634d8ea35ef3f19925246ae4b74d5d16

SHA1
22984a424abc5eb22f2af76c8272d51acbd5173e

SHA256
eee38e1683542e0c9d5941e0e6e3f331b4f8973f130ff02acee6602b2429b9cb

SHA512
7f09a6f67cfe024aec4cc1ac797d77f553a749b735aa075ef23acc79543097e1ce8895f56e519b236105c25c7237fba76e87cbeffc7abf8a5891981c6b5a725e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5498.tmp

Filesize
1KB

MD5
6c56ceeafc34783c0005c1b35879ef81

SHA1
ed329d28d7de34cdc56518767a6135000b1dacad

SHA256
7ff171cb59876e7f1286825e334d270719031078a969023065b35a35c546f915

SHA512
37518625e7eb8503c75b3dead29e938e3f63282b712844d96a05edb288649922fab581f9c37e7fc2a876d55fe94ef2d452d117a257142d2ccbf9c0a087c36b44

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA671.tmp

Filesize
1KB

MD5
30a7414a3134df7ef9106f66b7c2cc40

SHA1
2e6a458b2516046a511f849818e78df8cc5fc2b7

SHA256
4d7aaf4311b6bae7b963d9f94c1a0469f7036e022da7dca1b10c23942ba1c263

SHA512
cb87bb37ee742ba71f4c12a4433d77f46e0272a252334f5ff0ceca971e2a0e85b7bd83a2a25871be9d4c0ec79bb4f0d1c3357c7863c74e1a40ccae0f0e4028a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB1AC.tmp

Filesize
1KB

MD5
0efd6d5ecb931eff63147d77556362d8

SHA1
6d27ad935764eff7bdd4f4fdab6f27b77a87faf9

SHA256
cabb5d9d22e6ff1492ea3b6b4ad52a78a6d132757471c1dcac11484c7ea87752

SHA512
82ca215f0848bc4403a7f013f23a70a746a2780954307ede3d900891a2a66035d2f0067d91b8a29d6d988546d7f05a5a2b338bab08eb78336b512c7d7df41057

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB3DF.tmp

Filesize
1KB

MD5
9f62204da33f5d950fcd89b40ee60068

SHA1
ac571eba6aa3e907a8f4fa444d2c48887e645694

SHA256
192685f2f9666bff6c2e7767dbc3968d0a95c71e1e444b36961829a2f58e2a02

SHA512
8c7956c2e63ba23d57ed9efe585913f785bac93ed8ab3c272d40c4a469d7ce6801f8d08c02079376fdf8534a7f06d01b8930ab39450c65a2782dd17dd3fb8fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB40E.tmp

Filesize
1KB

MD5
6917f7191d15f290f46223039df51688

SHA1
b35ffc1608eac6c40f76d42a004e16466e4a56ba

SHA256
98873c7581493ea3158c8e67e9f540f14ef96ac633f878fcbbd44ec884d650dd

SHA512
f989315490a530ec7ee359f953dc182aa7dcb0033b8bf684dd523cdd29255ff325fe84b47ddea8aed996b12a977f4cc219594b939ea806548e14f5ab203d55b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB6CD.tmp

Filesize
1KB

MD5
bcfd5f7c5b1c9d74d1f5af967e3a4547

SHA1
c1c5173cce99065654716c806afc0842f1d2a1b3

SHA256
d735e4e239004605c3dd36f5b3e30ba8c4aef70026351d5cebd1b2eec7594e7c

SHA512
d28c77f7e424733c1380887497eb2b93bcc9fbec83449a883e18ef4f1d18be9595069151ae5e5844abedc84706c94193a67213f9519ab0c0c4bb3362c14fb443

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbrwi5m5.npj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cnqi2ef4\cnqi2ef4.dll

Filesize
3KB

MD5
a63d4f79863711e8d8751a01d6ba3d17

SHA1
95a5ab95c90e519e891b7ead5e3003490cc47f9a

SHA256
934c3156ee9c53ab47ef0eea204a68ba5860af11723de1a5b82c965175d3cd34

SHA512
d67dfa1d9b036adcd563d1801d975cb532b4212a3a7cc11ca84becadfd89cd6772e9984b6307e27405d35a0fdc1154b56cc4ed9a167f102cc08bd9f6a9696e2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ddpsjlvg\ddpsjlvg.dll

Filesize
3KB

MD5
255ac0509d8c99c7e5b1685667894ad2

SHA1
32c89a7b35f1788edbbbafaf7e69cfd7ccc50bda

SHA256
b58fc7f8d62fc1fb50e409ef22c0406d6f2695d7555cd0163047783b59312a08

SHA512
48a08f63becd08d169c7cf223b2c73285a4dd98f5ff49d223f3b8f9ea0527d080b9c3c92ccb62c90ce5a28d68c31bf26158e77881a554ffae8c00a3a63a5686a

Download Submit
C:\Users\Admin\AppData\Local\Temp\on5bbn3r\on5bbn3r.dll

Filesize
3KB

MD5
b0c7f78edc6ecd839c7339da453e52c1

SHA1
ade38bc4b44668af19cb7dde1ee8c6e13c5d2503

SHA256
07d7be78983d41092e7546803c76ae5070677ade67009805d95c704f298d6cd9

SHA512
724a1f54466771039877fad8beb3d5ff61753240c34012e7c41c5795146d65d8decc46aef974bd54fa7b37a33ed3fdec08067ba18b7ebf56201dd41223a313c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qakvqo0b\qakvqo0b.dll

Filesize
3KB

MD5
656e252bdfca11043a700ae9acbeef7a

SHA1
c34d50ff8c886329739c489bfd720c0fdc2f5993

SHA256
ccce3ff174fb1ff643a133e1a99e9bd3b1a9af82148a3db9fb6d3ee576a8666f

SHA512
a363fa702072d2212b30371e0e8688053b98bc36e9ab993034b6f5ef922f7c63447f794f4eaa804acecb30abc0789826a846b759c293bed2bef4d614819cf60c

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1015B

MD5
87f6bffa1f660e3af60660cabc475a7b

SHA1
9506848225d868ea160444202c0794bd8a65bdc7

SHA256
fd88197bdd877cd79805928a8ccb3a3c5fe478c53fbb9be6d17a66737eb15854

SHA512
c07c34259695a073e6fd8023757a112cf90b1aae90f16f0c3d93b0f1d665695eda9705b3d78c2854cd3713e4ed3d6ede35ab1ee54babaa908d7b7213ebee7732

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
31e0c4ea5c5ec8202910a63d248a2e22

SHA1
102e280b5d68464400a4cbe2db4819529c03d99e

SHA256
79e96164e0f2f8444bd834461cd7a6cf131562481f59f7770a16796bb7b2c3bc

SHA512
f931cc1f0be6833ac8007f72a0aaaba16dc2c48fe4c88676472bc7163a47d14ed937ddd4ace5ef5eeced4724d905a5df4b03da85c0439f67108319ba16faa867

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
a15890f1c4f9d02455c08a0e960a043c

SHA1
c41193a650eb8b22f3d2286ac177e41245d3ff32

SHA256
76b443b697ea1d3def9221a85534b342ba87277012d14cf262763846152f0ed3

SHA512
fce574ac405b0f56c4d4a8bbec9a52d83ead22365afb2890074bba2844fca56ca7ae8fd6f61edf392ab6590a5248aa87213494369c3f0aa358304bb55c99a9e4

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
b0f7770a7fa57d4cdd901c2120191a88

SHA1
ef93125b837cd6827b5779f5e1da5cf40c109bab

SHA256
c4766dcbd155ae71718b2fd2c9b1151255843f01023b4354a73e73b47d218d71

SHA512
8b0228618b585b7a74b9bf864587574ec7e63fe9c61f710bf5bf1a29e27cf970764bc534020ceca80c798e5cc95525dd78bd1684018b7b11166263f461b8734b

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
c240f984e0c33d395d3809b28adcce94

SHA1
fe0826af37dfb73f0f5e67e3b355c744e34e1a71

SHA256
1781997c3de0f5c0b240bcb72c8f155af71c44370123b7c10d57b0fd33cf1718

SHA512
035859250f21d4d27de5d4c49f2bcac40d3c8b1add98dd7994913e14e4ef4aaa8127764189fdbd02db7d87e29f6d8e80f4e423de3b896d9433150d362013703f

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
2KB

MD5
bda043cc9acbdc0996f3c64de228bf6e

SHA1
fe5c6ccb756599e933e5cff6757f65a353774d17

SHA256
974ca06323a806727ab5b6b4eb805b7eb38848c44ff7c561f611e8c217ed9127

SHA512
fa6b0aacb1c952180b6aaf4d2a080226ab550d518120865ea3cc4c9e420e72d9bada467dfc4cb9223d676c123bc9d73d21e39ff12a3cf4b6c122d63c945d3bc5

Download Submit
C:\Windows\System32\AntiRansom-zeRDiqjp.ps1

Filesize
34KB

MD5
bfb119ecc5767fce155199d439d2ef6a

SHA1
206a16a8cd984bc227baf921cc8d3da6032e6a4f

SHA256
1e6a72c58db5d7224f81cd51b0e2b591b3469c838d2e1bc64d06d64a666657fd

SHA512
806cd232681dcf54f46e3012ec85133417263a590640faada18cf38162eacd6b729d0dc7a254a7378d1820d3198227ebda739191f4c0ce0a17e64b3c23b27ba2

Download Submit
C:\Windows\Temp\ArataProtect-zeRDiqjp.ps1

Filesize
649B

MD5
4554e0b5bb09f3b97511f7b0868c3f3e

SHA1
d6c600a65720f4711c44f1d3123d646f654991a3

SHA256
3b22437408b2d5eee95d271a9ddf7582998bd0fcebba5fe802dd8320f1970fad

SHA512
08493e00cfbab8c0c573d5116a23a144eeed235310cabb11f88e170bdae21f113308e06ce57d2a6d2dd6525d3944b53fa160c86a85cf087b3a75fb86fa6a314b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1t2mfvf5\1t2mfvf5.0.cs

Filesize
249B

MD5
7df2964601813e20ea90bc7eca64b00b

SHA1
a8ad7c0e81f3b6edd66269283ff1603491edca3b

SHA256
daf8a1ae523190ef51054e143909966e01c3b6f531c72b9524d91254eacd6084

SHA512
4970916854df38bd3e55021c3d4f802b3db5a4d64a4570817edeb8c42d6e335a4e989bfcfdead96c2ee8776cc54ad09ef609090ccd34b849532d5f3f6caf42e0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1t2mfvf5\1t2mfvf5.cmdline

Filesize
369B

MD5
14954f1ca354c2fce685fbb3398b63cd

SHA1
b9458f3d2034dd477ebfe253e9e4b66e6df89207

SHA256
f475961b56a541b86e106ddc7816ac0ef8c30e8898fba80e315be51e1a2be661

SHA512
7faa8b9613df9b6ad30ad4eae05ab81a0097a11914d7e3b5ae981d36fa7a0f564838e8f2709544715623709aee683a17ed1a41fddd9a8136538abb240acb64a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1t2mfvf5\CSC84A887985674450BA2BA1356C1E4A728.TMP

Filesize
652B

MD5
42b6f25a197b9c14d76fe391ac24624e

SHA1
488c5460d15c68435fea528b56f4c84ec67c2b01

SHA256
71406c71fd36656da5b28c9efb19d4935a4bfc97ba720e2ec3f0583598c43bd3

SHA512
00ec0a921949b9dcb4b2236789e19544b37bf373ac5df174c7bfdb729cdb5c4834a4f6b016fc923f1a937eb1b4a0d8761632debdfff5e22bfe4f9c91eeabec3c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\50bdpuix\50bdpuix.cmdline

Filesize
369B

MD5
01262992a4d3e168a7afd4fefa903695

SHA1
62870231e628506585d2a983449df68157aae2f8

SHA256
c94f04f34b25528709cb7ad000c1eb0482f2f81197f4c4cdb66a1cdb1f5528ca

SHA512
1f8ffcf78791d3d0a71b85324a678aae4a1344637d53078ffe146de9c9c4e11a9347cfbe66862653d637d57fbb3533a6a5462f1fa6caebc4be230aba51a8e610

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\50bdpuix\CSC5B72D984FDEB4792BEF2EF62343A5B12.TMP

Filesize
652B

MD5
493f90112e15445fd5f87cee1dbdd83a

SHA1
b37ca352d23a7ee0a6889cddb7866a10ab328730

SHA256
62ec49d7759d037401601532e20e9b7cd2580b3c72dc848f3d38c46d0e02e3f7

SHA512
bdcdec66e92da6b919e66a8fe0400381c0f6bcade42985a19b63eac1165e47df7785650f7d21f1a96557b58cca8b995aeceab37bb5133df5990e75049f09c949

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cnqi2ef4\CSCFB6581DA84D04DCBB6BA2C9C2DA9FDEB.TMP

Filesize
652B

MD5
2137b78fa2dd9a49a8f527e3bc8223d2

SHA1
5bc89e177f73b1a616c7427ed34b170415eb7470

SHA256
11bb5fcdd1ef26488f6f6076f9fef3a178fa2fe0b4341c2cfce9b385ed89fbe8

SHA512
5ed80a7650baf9c3d33bb68b83a6375f06b8c44b99acf21c7f5992ceb52862df55c7496982d84846beb54a579f9420f71c279699a2d15d152ffca2c3382d81bc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cnqi2ef4\cnqi2ef4.0.cs

Filesize
696B

MD5
b794645974059bd125405f327c5ace77

SHA1
d332d8821d1eee8e5db75ec151df5ec945bec334

SHA256
afd81c914fe8fa7ee32be6a797f46a2a829908b45d59100c1052a7baf2a347da

SHA512
dc8e4aa0b35a02d7f43868bce8602ac3941341f74e2f2de6bb79dbb8eb9372431cd7179f3701a09d574ea449735738d9ba368b78fe4fe7fa6f9856536c19f8f8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\cnqi2ef4\cnqi2ef4.cmdline

Filesize
369B

MD5
83819327ff2ad81d8b09724553dc2c84

SHA1
62e2b9b545d45be5e7dbb708853fcf3151f253f1

SHA256
6f2a1545ad3d1bc715a14370a33383462e216a05fdf08635cd4883a897ceb7a1

SHA512
85638b08861992f6ea988375272e6d89e6a0199e4effc4ceef0f5c9680898e897d4f9a7ce2dfded1555a05ff3eb6df520ceaaf1def3d8dd4743829088d8b9d93

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ddpsjlvg\CSC939B428BD1644B87B4E8361CEFE57DFF.TMP

Filesize
652B

MD5
ace86a096cb7ef0094479fc090e99927

SHA1
b5530ca057f617d6ef96952e007d928b6907e987

SHA256
bd23a01b5a921e652a3637b2e420b67f23fc8ad3542f6749b064e76dff903511

SHA512
6933ebc87ac54075174a4d8d6560369a72a1087727e66fec05f38d6ea49290ea35034de08c27bdb9a8ae891fbecc87d4828f20f03decd56e93177a2fe5cd2e25

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ddpsjlvg\ddpsjlvg.0.cs

Filesize
425B

MD5
bf0bab0ec41a16f88aefa9f29543514d

SHA1
432334393245d6f0c05afc6cd07c99f4eacfaca9

SHA256
2eb1b6bd7727d8842685e02140e0a79c8e99aba04205acd4eb3e51250de5704b

SHA512
dc0c3b44989453ed2f5c8dda5b8a15041e58df27bf39475df904eac1df0ab058c221bf005d7814e30678f121e2b3a6b7c002a0b7be8408e5704a2dbc2e7c4bd0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ddpsjlvg\ddpsjlvg.cmdline

Filesize
369B

MD5
19ba4b1bc42020f7966e8a51826b0601

SHA1
2ccea44558365a36ea2a702747855aaad1c7cae5

SHA256
97009c1bb821532dd9d04dfcaf908de650ebd716ca39402e93df6d4de8a3e167

SHA512
8502f504243c70f42b1a72b446284c189c0fa91efc2d55efcd39fdbea29a0cea846fc0db0ded5f2e6c7dc5cfea7bcb4519d7eb20dec3126484692e2e9db6fa23

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\on5bbn3r\CSC44B42FCB21CF408D8BAD39207328CDB2.TMP

Filesize
652B

MD5
46e29ab2173902fb4b5c476365fc1e37

SHA1
45c696dac285f0222dec45b1bad80ec8cfc97b23

SHA256
5b88ebb4019ee2ff0a3946e327120b9e0b12d5157f6d3291373736c3b99ca406

SHA512
9c91fbf9f8b89c583bba6a3b20a8a5fa35991256bec193071a759f703eb74747e01e9a77090e814fa2737c2a8a143730ba3e935ad3f27b3644085ac68700a587

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\on5bbn3r\on5bbn3r.cmdline

Filesize
369B

MD5
a67616c6d6d718324b4d783495a6d9c7

SHA1
e6009f8038b01306557d364671fee5a36d53ab7c

SHA256
e94360640372e34dce4dd8c007edf8e4414e4b73072d256d3c580afa95fd2700

SHA512
ab900cdd3ebecb32c780ea7d19ce567555ae8cef2950ba11ec8aed44cf6c624265bad27d02361a1c6198db6ff703d9aed1592954921f42dc6230cbd908624c09

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qakvqo0b\CSCEE74B9E750174D539A2F43F7CEEF25A3.TMP

Filesize
652B

MD5
05749dbcfa5fb67fe664ac9c2b685527

SHA1
a38734666075889d6eb21ccca32f2e6ad4d39af7

SHA256
ec37a2167a5dcf2b8ce4ce2ef7cd21384474f9a9d94d504c69126e87012bdde4

SHA512
80e8027936cb8f6ae4f425402cf96b128e1db36e7b92f0c839e70126f84366dde41657c31beb9b6471e34ca2c191535eab49fa3a01c357670fb1619eca00ddd6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qakvqo0b\qakvqo0b.cmdline

Filesize
369B

MD5
8a6e8a15e5cc77403b8c83dee4bbc476

SHA1
9517fc10858d583036679102376582c150e44173

SHA256
facdb001a76369c124f1accf178e7314689b97aa5b5d6aa6004b21f65b21434b

SHA512
64070c58601010e599432b13183609959a9862bc1acae3e91c0f488cab8c2b4ee57bd1dbbb7ffe9e6ead8ae9bf1581982b87ff33ff189e679fb13c13449ef8ca

Download Submit
memory/3304-27-0x00007FFA2EF20000-0x00007FFA2F9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-25-0x0000028860910000-0x0000028860918000-memory.dmp

Filesize
32KB

Download
memory/3304-0-0x00007FFA2EF23000-0x00007FFA2EF25000-memory.dmp

Filesize
8KB

Download
memory/3304-77-0x0000028860D50000-0x0000028860D58000-memory.dmp

Filesize
32KB

Download
memory/3304-12-0x00007FFA2EF20000-0x00007FFA2F9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-31-0x00007FFA2EF20000-0x00007FFA2F9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-34-0x00007FFA2EF20000-0x00007FFA2F9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-33-0x00007FFA2EF20000-0x00007FFA2F9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-32-0x00007FFA2EF23000-0x00007FFA2EF25000-memory.dmp

Filesize
8KB

Download
memory/3304-48-0x0000028860A60000-0x0000028860A68000-memory.dmp

Filesize
32KB

Download
memory/3304-11-0x00007FFA2EF20000-0x00007FFA2F9E1000-memory.dmp

Filesize
10.8MB

Download
memory/3304-1-0x00000288607C0000-0x00000288607E2000-memory.dmp

Filesize
136KB

Download
memory/3752-175-0x000002594CBA0000-0x000002594CBA8000-memory.dmp

Filesize
32KB

Download
memory/4248-140-0x00000164EB470000-0x00000164EB478000-memory.dmp

Filesize
32KB

Download
memory/4708-131-0x000001B84D990000-0x000001B84D998000-memory.dmp

Filesize
32KB

Download