bbcfe2f3c7c1253bc2fea8f858cf887b36c363ed90a3160b6cf19ee2b5a9acbd

Analysis

max time kernel
45s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2025, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spragmos.ps1
Size

34KB
MD5

1ff55d58db5098bc348b64c56f7e5275
SHA1

042a98b432daff9e99a5af37e748b4b2d66ee763
SHA256

bbcfe2f3c7c1253bc2fea8f858cf887b36c363ed90a3160b6cf19ee2b5a9acbd
SHA512

8e7a5dc1d9d642e0370f778efc57e378bf29d4140414fe5f4ce85345202e6e5cd397aeab1376ab3887da1abce5d72ca2b4b7fe4a35afb1637ffbd890435b0f58
SSDEEP

384:tqz/spUBSzj5mMEEpi0D04eEMls/11AUfoUHadPw3+4CFYw5jICfyQY:kM5mME00xEbrl6Bq+409I9QY

Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000d000000024231-111.dat	disable_win_def

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AlertAleph-mNbZXBtE.ps1\" -HiddenRun"	powershell.exe

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1996	Process not Found
4600	wevtutil.exe
4156	wevtutil.exe
4600	wevtutil.exe
4620	wevtutil.exe
276	Process not Found
1244	Process not Found
4416	Process not Found
2128	wevtutil.exe
3800	wevtutil.exe
3100	Process not Found
4528	Process not Found
4960	wevtutil.exe
4060	wevtutil.exe
1736	wevtutil.exe
1940	wevtutil.exe
3908	wevtutil.exe
288	Process not Found
3616	Process not Found
3556	wevtutil.exe
4928	Process not Found
304	Process not Found
3316	wevtutil.exe
556	wevtutil.exe
3308	wevtutil.exe
2952	wevtutil.exe
1112	wevtutil.exe
536	Process not Found
1440	wevtutil.exe
1520	Process not Found
3100	Process not Found
4208	Process not Found
2752	wevtutil.exe
2552	wevtutil.exe
3428	wevtutil.exe
2432	wevtutil.exe
4260	wevtutil.exe
3016	Process not Found
2044	Process not Found
536	Process not Found
1244	wevtutil.exe
464	wevtutil.exe
232	wevtutil.exe
4016	Process not Found
268	Process not Found
276	Process not Found
304	Process not Found
1732	wevtutil.exe
4488	wevtutil.exe
512	wevtutil.exe
3204	Process not Found
996	wevtutil.exe
3100	Process not Found
1368	wevtutil.exe
868	wevtutil.exe
1700	wevtutil.exe
4116	Process not Found
4948	Process not Found
4920	wevtutil.exe
3228	Process not Found
4128	Process not Found
4928	Process not Found
4928	Process not Found
1924	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3368	Process not Found
820	Process not Found
1244	Process not Found
1820	Process not Found
2508	powershell.exe
2136	Process not Found

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHealth = "powershell -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\Spragmos.ps1\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdateCheck = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AlertAleph-mNbZXBtE.ps1\" -HiddenRun"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdateCheck = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Windows\\System32\\AlertAleph-mNbZXBtE.ps1\" -HiddenRun"	powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3172	Process not Found
3560	Process not Found

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3720	wevtutil.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\AlertAleph-mNbZXBtE.ps1	powershell.exe
File opened for modification	C:\Windows\System32\config\systemprofile:Jakatatales.ps1	powershell.exe
File created	C:\Windows\System32\AlertAleph-mNbZXBtE.ps1	powershell.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3208	Process not Found

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2028	wevtutil.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3100	Process not Found

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000_Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\InprocServer32\	powershell.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
2136	Process not Found
2136	Process not Found
2136	Process not Found
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
2508	powershell.exe
820	Process not Found
820	Process not Found
3368	Process not Found
3368	Process not Found
1244	Process not Found
1244	Process not Found
820	Process not Found
3368	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	powershell.exe
Token: SeSecurityPrivilege	4692	wevtutil.exe
Token: SeBackupPrivilege	4692	wevtutil.exe
Token: SeSecurityPrivilege	2908	wevtutil.exe
Token: SeBackupPrivilege	2908	wevtutil.exe
Token: SeSecurityPrivilege	4852	wevtutil.exe
Token: SeBackupPrivilege	4852	wevtutil.exe
Token: SeSecurityPrivilege	1408	wevtutil.exe
Token: SeBackupPrivilege	1408	wevtutil.exe
Token: SeSecurityPrivilege	2824	wevtutil.exe
Token: SeBackupPrivilege	2824	wevtutil.exe
Token: SeSecurityPrivilege	4960	wevtutil.exe
Token: SeBackupPrivilege	4960	wevtutil.exe
Token: SeSecurityPrivilege	412	wevtutil.exe
Token: SeBackupPrivilege	412	wevtutil.exe
Token: SeSecurityPrivilege	1344	wevtutil.exe
Token: SeBackupPrivilege	1344	wevtutil.exe
Token: SeSecurityPrivilege	1652	wevtutil.exe
Token: SeBackupPrivilege	1652	wevtutil.exe
Token: SeSecurityPrivilege	1220	wevtutil.exe
Token: SeBackupPrivilege	1220	wevtutil.exe
Token: SeSecurityPrivilege	4376	wevtutil.exe
Token: SeBackupPrivilege	4376	wevtutil.exe
Token: SeSecurityPrivilege	3956	wevtutil.exe
Token: SeBackupPrivilege	3956	wevtutil.exe
Token: SeSecurityPrivilege	4192	wevtutil.exe
Token: SeBackupPrivilege	4192	wevtutil.exe
Token: SeSecurityPrivilege	1524	wevtutil.exe
Token: SeBackupPrivilege	1524	wevtutil.exe
Token: SeSecurityPrivilege	2952	wevtutil.exe
Token: SeBackupPrivilege	2952	wevtutil.exe
Token: SeSecurityPrivilege	4880	wevtutil.exe
Token: SeBackupPrivilege	4880	wevtutil.exe
Token: SeSecurityPrivilege	1924	wevtutil.exe
Token: SeBackupPrivilege	1924	wevtutil.exe
Token: SeSecurityPrivilege	4412	wevtutil.exe
Token: SeBackupPrivilege	4412	wevtutil.exe
Token: SeSecurityPrivilege	2588	wevtutil.exe
Token: SeBackupPrivilege	2588	wevtutil.exe
Token: SeSecurityPrivilege	3264	wevtutil.exe
Token: SeBackupPrivilege	3264	wevtutil.exe
Token: SeSecurityPrivilege	4548	wevtutil.exe
Token: SeBackupPrivilege	4548	wevtutil.exe
Token: SeSecurityPrivilege	1972	wevtutil.exe
Token: SeBackupPrivilege	1972	wevtutil.exe
Token: SeSecurityPrivilege	5016	wevtutil.exe
Token: SeBackupPrivilege	5016	wevtutil.exe
Token: SeSecurityPrivilege	2524	wevtutil.exe
Token: SeBackupPrivilege	2524	wevtutil.exe
Token: SeSecurityPrivilege	3376	wevtutil.exe
Token: SeBackupPrivilege	3376	wevtutil.exe
Token: SeSecurityPrivilege	2436	wevtutil.exe
Token: SeBackupPrivilege	2436	wevtutil.exe
Token: SeSecurityPrivilege	3428	wevtutil.exe
Token: SeBackupPrivilege	3428	wevtutil.exe
Token: SeSecurityPrivilege	4696	wevtutil.exe
Token: SeBackupPrivilege	4696	wevtutil.exe
Token: SeSecurityPrivilege	1244	wevtutil.exe
Token: SeBackupPrivilege	1244	wevtutil.exe
Token: SeSecurityPrivilege	1168	wevtutil.exe
Token: SeBackupPrivilege	1168	wevtutil.exe
Token: SeSecurityPrivilege	3556	wevtutil.exe
Token: SeBackupPrivilege	3556	wevtutil.exe
Token: SeSecurityPrivilege	1872	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 3952	2508	powershell.exe	87
PID 2508 wrote to memory of 3952	2508	powershell.exe	87
PID 3952 wrote to memory of 1828	3952	csc.exe	90
PID 3952 wrote to memory of 1828	3952	csc.exe	90
PID 2508 wrote to memory of 2360	2508	powershell.exe	92
PID 2508 wrote to memory of 2360	2508	powershell.exe	92
PID 2508 wrote to memory of 4692	2508	powershell.exe	94
PID 2508 wrote to memory of 4692	2508	powershell.exe	94
PID 2508 wrote to memory of 2908	2508	powershell.exe	95
PID 2508 wrote to memory of 2908	2508	powershell.exe	95
PID 2508 wrote to memory of 4852	2508	powershell.exe	170
PID 2508 wrote to memory of 4852	2508	powershell.exe	170
PID 2508 wrote to memory of 1408	2508	powershell.exe	171
PID 2508 wrote to memory of 1408	2508	powershell.exe	171
PID 2508 wrote to memory of 2824	2508	powershell.exe	99
PID 2508 wrote to memory of 2824	2508	powershell.exe	99
PID 2508 wrote to memory of 4960	2508	powershell.exe	100
PID 2508 wrote to memory of 4960	2508	powershell.exe	100
PID 2508 wrote to memory of 412	2508	powershell.exe	174
PID 2508 wrote to memory of 412	2508	powershell.exe	174
PID 2508 wrote to memory of 1344	2508	powershell.exe	175
PID 2508 wrote to memory of 1344	2508	powershell.exe	175
PID 2508 wrote to memory of 1652	2508	powershell.exe	176
PID 2508 wrote to memory of 1652	2508	powershell.exe	176
PID 2508 wrote to memory of 1220	2508	powershell.exe	104
PID 2508 wrote to memory of 1220	2508	powershell.exe	104
PID 2508 wrote to memory of 4376	2508	powershell.exe	105
PID 2508 wrote to memory of 4376	2508	powershell.exe	105
PID 2508 wrote to memory of 3956	2508	powershell.exe	106
PID 2508 wrote to memory of 3956	2508	powershell.exe	106
PID 2508 wrote to memory of 4192	2508	powershell.exe	180
PID 2508 wrote to memory of 4192	2508	powershell.exe	180
PID 2508 wrote to memory of 1524	2508	powershell.exe	108
PID 2508 wrote to memory of 1524	2508	powershell.exe	108
PID 2508 wrote to memory of 2952	2508	powershell.exe	181
PID 2508 wrote to memory of 2952	2508	powershell.exe	181
PID 2508 wrote to memory of 4880	2508	powershell.exe	110
PID 2508 wrote to memory of 4880	2508	powershell.exe	110
PID 2508 wrote to memory of 1924	2508	powershell.exe	182
PID 2508 wrote to memory of 1924	2508	powershell.exe	182
PID 2508 wrote to memory of 4412	2508	powershell.exe	112
PID 2508 wrote to memory of 4412	2508	powershell.exe	112
PID 2508 wrote to memory of 2588	2508	powershell.exe	113
PID 2508 wrote to memory of 2588	2508	powershell.exe	113
PID 2508 wrote to memory of 3264	2508	powershell.exe	184
PID 2508 wrote to memory of 3264	2508	powershell.exe	184
PID 2508 wrote to memory of 4548	2508	powershell.exe	115
PID 2508 wrote to memory of 4548	2508	powershell.exe	115
PID 2508 wrote to memory of 1972	2508	powershell.exe	116
PID 2508 wrote to memory of 1972	2508	powershell.exe	116
PID 2508 wrote to memory of 5016	2508	powershell.exe	117
PID 2508 wrote to memory of 5016	2508	powershell.exe	117
PID 2508 wrote to memory of 2524	2508	powershell.exe	118
PID 2508 wrote to memory of 2524	2508	powershell.exe	118
PID 2508 wrote to memory of 3376	2508	powershell.exe	120
PID 2508 wrote to memory of 3376	2508	powershell.exe	120
PID 2508 wrote to memory of 2436	2508	powershell.exe	188
PID 2508 wrote to memory of 2436	2508	powershell.exe	188
PID 2508 wrote to memory of 3428	2508	powershell.exe	189
PID 2508 wrote to memory of 3428	2508	powershell.exe	189
PID 2508 wrote to memory of 4696	2508	powershell.exe	190
PID 2508 wrote to memory of 4696	2508	powershell.exe	190
PID 2508 wrote to memory of 1244	2508	powershell.exe	124
PID 2508 wrote to memory of 1244	2508	powershell.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Spragmos.ps1
1⤵
- Modifies WinLogon for persistence
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z5vn1nbo\z5vn1nbo.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA19F.tmp" "c:\Users\Admin\AppData\Local\Temp\z5vn1nbo\CSCAA9651197849F698B38383E367E77.TMP"
    3⤵
    PID:1828
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /run /tn \Microsoft\Windows\SomeTask
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" el
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl AMSI/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl AirSpaceChannel
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Application
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl DirectShowFilterGraph
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl DirectShowPluginControl
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Els_Hyphenation/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl EndpointMapper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl FirstUXPerf-Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl ForwardedEvents
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "General Logging"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl HardwareEvents
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl IHM_DebugChannel
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS-GPIO/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS-I2C/Analytic
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-GPIO2/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-GPIO2/Performance
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-I2C/Debug
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2588
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Intel-iaLPSS2-I2C/Performance
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Internet Explorer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Key Management Service"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationDeviceMFT
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationDeviceProxy
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MF_MediaFoundationFrameServer
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MedaFoundationVideoProc
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MedaFoundationVideoProcD3D
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationAsyncWrapper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationContentProtection
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationDS
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationDeviceProxy
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationMP4
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationMediaEngine
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPerformance
  2⤵
  PID:2788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPerformanceCore
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPipeline
  2⤵
  PID:3720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationPlatform
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl MediaFoundationSrcPrefetch
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client-Streamingux/Debug
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Admin
  2⤵
  PID:4060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Debug
  2⤵
  PID:4904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-Client/Operational
  2⤵
  PID:1108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-AppV-Client/Virtual Applications"
  2⤵
  PID:4000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-AppV-SharedPerformance/Analytic
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Admin
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Debug
  2⤵
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Client-Licensing-Platform/Diagnostic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-IE/Diagnostic
  2⤵
  PID:748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-IEFRAME/Diagnostic
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-JSDumpHeap/Diagnostic
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-OneCore-Setup/Analytic
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-PerfTrack-IEFRAME/Diagnostic
  2⤵
  PID:556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-PerfTrack-MSHTML/Diagnostic
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Admin/Debug"
  2⤵
  PID:2752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
  2⤵
  PID:4368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
  2⤵
  - Clears Windows event logs
  PID:2552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
  2⤵
  PID:2860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Debug"
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-App Agent/Operational"
  2⤵
  PID:1668
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-IPC/Operational"
  2⤵
  PID:3596
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
  2⤵
  PID:4420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
  2⤵
  PID:1812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Analytic
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AAD/Operational
  2⤵
  PID:112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ADSI/Debug
  2⤵
  PID:812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ASN1/Operational
  2⤵
  PID:888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ATAPort/General
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ATAPort/SATA-LPM
  2⤵
  PID:876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ActionQueue/Analytic
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-All-User-Install-Agent/Admin
  2⤵
  PID:1992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Debug
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AllJoyn/Operational
  2⤵
  PID:1408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Admin
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/ApplicationTracing
  2⤵
  PID:2848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Diagnostic
  2⤵
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppHost/Internal
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppID/Operational
  2⤵
  PID:1652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/EXE and DLL"
  2⤵
  PID:4136
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/MSI and Script"
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Admin
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Analytic
  2⤵
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Debug
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-Runtime/Diagnostics
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-State/Debug
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppModel-State/Diagnostic
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Admin
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Debug
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppReadiness/Operational
  2⤵
  PID:4696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppSruProv
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Diagnostic
  2⤵
  PID:3624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeployment/Operational
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Debug
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Diagnostic
  2⤵
  PID:220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Operational
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppXDeploymentServer/Restricted
  2⤵
  PID:1820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Analytic
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ApplicabilityEngine/Operational
  2⤵
  PID:4360
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Admin"
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Analytic"
  2⤵
  PID:4092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Debug"
  2⤵
  PID:3272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Application Server-Applications/Operational"
  2⤵
  PID:3368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant
  2⤵
  PID:720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter
  2⤵
  PID:1840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Inventory
  2⤵
  PID:512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Program-Telemetry
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Application-Experience/Steps-Recorder
  2⤵
  PID:3616
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Debug
  2⤵
  - Clears Windows event logs
  PID:2752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Operational
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AppxPackaging/Performance
  2⤵
  PID:2024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Admin
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccess/Operational
  2⤵
  PID:2080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Admin
  2⤵
  PID:4600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AssignedAccessBroker/Operational
  2⤵
  PID:2384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AsynchronousCausality/Causality
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/CaptureMonitor
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/GlitchDetection
  2⤵
  PID:112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Informational
  2⤵
  PID:812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Operational
  2⤵
  PID:888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/Performance
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audio/PlaybackManager
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Audit/Analytic
  2⤵
  PID:4004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Authentication User Interface/Operational"
  2⤵
  PID:968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController
  2⤵
  PID:5112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUser-Client
  2⤵
  PID:1516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController
  2⤵
  PID:2512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-AxInstallService/Log
  2⤵
  PID:756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHPORT/HCI
  2⤵
  PID:4120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHPORT/L2CAP
  2⤵
  PID:5036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHUSB/Diagnostic
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BTH-BTHUSB/Performance
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic
  2⤵
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTaskInfrastructure/Operational
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational
  2⤵
  PID:1504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Backup
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Connections/Operational
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Battery/Diagnostic
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Analytic
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Biometrics/Operational
  2⤵
  PID:1096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Admin
  2⤵
  PID:4464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-DrivePreparationTool/Operational
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker-Driver-Performance/Operational
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Management"
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-BitLocker/BitLocker Operational"
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BitLocker/Tracing
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Analytic
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bits-Client/Operational
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Bthmini/Operational
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-MTPEnum/Operational
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Bluetooth-Policy/Operational
  2⤵
  PID:1108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCache/Operational
  2⤵
  PID:4092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic
  2⤵
  PID:3272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheEventProvider/Diagnostic
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheMonitoring/Analytic
  2⤵
  PID:2460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Analytic
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-BranchCacheSMB/Operational
  2⤵
  PID:4416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CAPI2/Operational
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CDROM/Operational
  2⤵
  PID:1840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/Analytic
  2⤵
  PID:512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ApartmentInitialize
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ApartmentUninitialize
  2⤵
  PID:2980
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/Call
  2⤵
  PID:4388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/CreateInstance
  2⤵
  PID:4084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/ExtensionCatalog
  2⤵
  PID:3312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/FreeUnusedLibrary
  2⤵
  PID:2024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COM/RundownInstrumentation
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/Activations
  2⤵
  PID:2080
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/MessageProcessing
  2⤵
  PID:4600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-COMRuntime/Tracing
  2⤵
  PID:636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertPoleEng/Operational
  2⤵
  PID:1828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational
  2⤵
  PID:336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational
  2⤵
  PID:112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Cleanmgr/Diagnostic
  2⤵
  PID:4684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ClearTypeTextTuner/Diagnostic
  2⤵
  PID:4876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Debug
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CloudStore/Operational
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CmiSetup/Analytic
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Operational
  2⤵
  - Clears Windows event logs
  PID:4960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CodeIntegrity/Verbose
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ComDlg32/Analytic
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ComDlg32/Debug
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Analytic
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Compat-Appraiser/Operational
  2⤵
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Debug
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-BindFlt/Operational
  2⤵
  PID:1804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Debug
  2⤵
  PID:2344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcifs/Operational
  2⤵
  PID:4016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Debug
  2⤵
  PID:4992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Containers-Wcnfs/Operational
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Diagnostic
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Operational
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreApplication/Tracing
  2⤵
  PID:1972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug
  2⤵
  PID:2016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreWindow/Analytic
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CoreWindow/Debug
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Client/Operational
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CorruptedFileRecovery-Server/Operational
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crashdump/Operational
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-CredUI/Diagnostic
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-BCRYPT/Analytic
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-CNG/Analytic
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Debug
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DPAPI/Operational
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-DSSEnh/Analytic
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-NCrypt/Operational
  2⤵
  PID:4360
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-RNG/Analytic
  2⤵
  PID:4904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Crypto-RSAEnh/Analytic
  2⤵
  PID:2284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-D3D10Level9/Analytic
  2⤵
  PID:4000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-D3D10Level9/PerfTiming
  2⤵
  PID:324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Analytic
  2⤵
  PID:3368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAL-Provider/Operational
  2⤵
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DAMM/Diagnostic
  2⤵
  PID:720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DCLocator/Debug
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DDisplay/Analytic
  2⤵
  PID:4488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DDisplay/Logging
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DLNA-Namespace/Analytic
  2⤵
  PID:4948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DNS-Client/Operational
  2⤵
  - Clears Windows event logs
  PID:556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Admin
  2⤵
  PID:4624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Analytic
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Debug
  2⤵
  PID:4396
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DSC/Operational
  2⤵
  PID:2552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DUI/Diagnostic
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DUSER/Diagnostic
  2⤵
  PID:2364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXGI/Analytic
  2⤵
  PID:3788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXGI/Logging
  2⤵
  PID:1020
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DXP/Analytic
  2⤵
  PID:752
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Data-Pdf/Debug
  2⤵
  PID:2384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/Admin
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DataIntegrityScan/CrashRecovery
  2⤵
  PID:244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Analytic
  2⤵
  PID:2172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Debug
  2⤵
  PID:4160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DateTimeControlPanel/Operational
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Diagnostic
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Operational
  2⤵
  PID:876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Performance
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deduplication/Scrubbing
  2⤵
  PID:440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Defrag-Core/Debug
  2⤵
  PID:652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Deplorch/Analytic
  2⤵
  PID:4004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DesktopActivityModerator/Diagnostic
  2⤵
  PID:968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic
  2⤵
  PID:2848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceAssociationService/Performance
  2⤵
  - Clears Windows event logs
  PID:1440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceConfidence/Analytic
  2⤵
  PID:3204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Operational
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceGuard/Verbose
  2⤵
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin
  2⤵
  PID:448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug
  2⤵
  PID:2084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Admin
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Analytic
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Debug
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSetupManager/Operational
  2⤵
  PID:756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Analytic
  2⤵
  PID:4120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceSync/Operational
  2⤵
  PID:5036
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUpdateAgent/Operational
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUx/Informational
  2⤵
  PID:764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DeviceUx/Performance
  2⤵
  PID:1600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Devices-Background/Operational
  2⤵
  PID:2564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Admin
  2⤵
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcp-Client/Operational
  2⤵
  PID:4408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Admin
  2⤵
  PID:3108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dhcpv6-Client/Operational
  2⤵
  PID:5088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiagCpl/Debug
  2⤵
  PID:2604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Analytic
  2⤵
  PID:4128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Debug
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-DPS/Operational
  2⤵
  PID:1168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-MSDE/Debug
  2⤵
  PID:4464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Analytic
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Debug
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PCW/Operational
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Debug
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-PLA/Operational
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Perfhost/Analytic
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scheduled/Operational
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Admin
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Analytic
  2⤵
  PID:3320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Debug
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-Scripted/Operational
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational
  2⤵
  PID:4988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-WDC/Analytic
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnosis-WDI/Debug
  2⤵
  PID:1608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Debug
  2⤵
  PID:3548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Networking/Operational
  2⤵
  - Clears Windows event logs
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic
  2⤵
  PID:656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Diagnostic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback
  2⤵
  PID:1420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Diagnostics-Performance/Operational
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D10/Analytic
  2⤵
  PID:2024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D10_1/Analytic
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/Analytic
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/Logging
  2⤵
  PID:3260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D11/PerfTiming
  2⤵
  PID:812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/Analytic
  2⤵
  PID:888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/Logging
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D12/PerfTiming
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3D9/Analytic
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Direct3DShaderCache/Default
  2⤵
  PID:4504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectComposition/Diagnostic
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectManipulation/Diagnostic
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectShow-KernelSupport/Performance
  2⤵
  PID:4164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DirectSound/Debug
  2⤵
  PID:3100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Disk/Operational
  2⤵
  PID:3648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnostic/Operational
  2⤵
  PID:4828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticDataCollector/Operational
  2⤵
  PID:1580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DiskDiagnosticResolver/Operational
  2⤵
  PID:2520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/Analytic
  2⤵
  PID:3800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/ExternalAnalytic
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Api/InternalAnalytic
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dism-Cli/Analytic
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Debug
  2⤵
  PID:1724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplayColorCalibration/Operational
  2⤵
  PID:1652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DisplaySwitch/Diagnostic
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Documents/Performance
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dot3MM/Diagnostic
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DriverFrameworks-UserMode/Operational
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DucUpdateAgent/Operational
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-API/Diagnostic
  2⤵
  PID:1152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Core/Diagnostic
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Dwm/Diagnostic
  2⤵
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Redir/Diagnostic
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Dwm-Udwm/Diagnostic
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Admin
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl-Operational
  2⤵
  PID:2416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Contention
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Diagnostic
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Performance
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxgKrnl/Power
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-DxpTaskSyncProvider/Analytic
  2⤵
  PID:1748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Application-Learning/Admin
  2⤵
  PID:2788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-Regular/Admin
  2⤵
  PID:2176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EDP-Audit-TCB/Admin
  2⤵
  PID:5008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EFS/Debug
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/IODiagnose
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ESE/Operational
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Analytic
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Debug
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapHost/Operational
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasChap/Operational
  2⤵
  PID:3320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-RasTls/Operational
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Sim/Operational
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EapMethods-Ttls/Operational
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EaseOfAccess/Diagnostic
  2⤵
  PID:3368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/EventLog
  2⤵
  - Clears Windows event logs
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Energy-Estimation-Engine/Trace
  2⤵
  PID:720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Debug
  2⤵
  - Clears Windows event logs
  PID:4488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventCollector/Operational
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog-WMIProvider/Debug
  2⤵
  PID:512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog/Analytic
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-EventLog/Debug
  2⤵
  PID:1420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Analytic
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Debug
  2⤵
  PID:2024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FMS/Operational
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FailoverClustering-Client/Diagnostic
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Fault-Tolerant-Heap/Operational
  2⤵
  PID:1112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Analytic
  2⤵
  PID:4168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FeatureConfiguration/Operational
  2⤵
  PID:4684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Catalog/Analytic
  2⤵
  PID:4876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Catalog/Debug
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-ConfigManager/Analytic
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-ConfigManager/Debug
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/Analytic
  2⤵
  PID:5092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/Debug
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Core/WHC
  2⤵
  PID:3408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/Analytic
  2⤵
  PID:1516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/BackupLog
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Engine/Debug
  2⤵
  PID:3756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-EventListener/Analytic
  2⤵
  PID:2368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-EventListener/Debug
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Service/Analytic
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-Service/Debug
  2⤵
  PID:1332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-UI-Events/Analytic
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileHistory-UI-Events/Debug
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-FileInfoMinifilter/Operational
  2⤵
  PID:1724
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Firewall-CPL/Diagnostic
  2⤵
  PID:1652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Folder Redirection/Operational"
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Debug
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Forwarding/Operational
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GPIO-ClassExtension/Analytic
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GenericRoaming/Admin
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-GroupPolicy/Operational
  2⤵
  PID:1152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HAL/Debug
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenter/Debug
  2⤵
  - Clears Windows event logs
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenter/Performance
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HealthCenterCPL/Performance
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HelloForBusiness/Operational
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Help/Operational
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
  2⤵
  PID:4128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
  2⤵
  - Clears Windows event logs
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
  2⤵
  PID:1604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
  2⤵
  PID:1748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HomeGroup-ListenerService
  2⤵
  PID:2788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Analytic
  2⤵
  PID:2176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HotspotAuth/Operational
  2⤵
  PID:220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Log
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-HttpService/Trace
  2⤵
  PID:548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Admin
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic
  2⤵
  - Clears Windows event logs
  PID:4060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Debug
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose
  2⤵
  PID:3320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Guest-Drivers/Operational
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Admin
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Analytic
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-Hypervisor-Operational
  2⤵
  PID:2940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-NETVSC/Diagnostic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Admin
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Hyper-V-VID-Analytic
  2⤵
  PID:4488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IE-SmartScreen
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKE/Operational
  2⤵
  PID:1840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IKEDBG/Debug
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-Broker/Analytic
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CandidateUI/Analytic
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CustomerFeedbackManager/Debug
  2⤵
  PID:4600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPAPI/Analytic
  2⤵
  PID:112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPLMP/Analytic
  2⤵
  PID:4500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPPRED/Analytic
  2⤵
  PID:3580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPSetting/Analytic
  2⤵
  PID:1256
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-JPTIP/Analytic
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-KRAPI/Analytic
  2⤵
  PID:232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-KRTIP/Analytic
  2⤵
  PID:4960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-OEDCompiler/Analytic
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TCCORE/Analytic
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TCTIP/Analytic
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IME-TIP/Analytic
  2⤵
  PID:4556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPNAT/Diagnostic
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPSEC-SRV/Diagnostic
  2⤵
  PID:3684
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Debug
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IPxlatCfg/Operational
  2⤵
  PID:3288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Analytic
  2⤵
  PID:728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IdCtrls/Operational
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic
  2⤵
  PID:1560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Input-HIDCLASS-Analytic
  2⤵
  PID:2512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-InputSwitch/Diagnostic
  2⤵
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-International-RegionalOptionsControlPanel/Operational
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Debug
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Operational
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Iphlpsvc/Trace
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KdsSvc/Operational
  2⤵
  PID:4564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kerberos/Operational
  2⤵
  PID:2044
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Acpi/Diagnostic
  2⤵
  PID:4056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-AppCompat/General
  2⤵
  - Clears Windows event logs
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-AppCompat/Performance
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Analytic
  2⤵
  PID:1504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Debug
  2⤵
  PID:1972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ApphelpCache/Operational
  2⤵
  PID:2016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Analytic
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Boot/Operational
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Disk/Analytic
  2⤵
  PID:1096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Admin
  2⤵
  PID:4696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-EventTracing/Analytic
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-File/Analytic
  2⤵
  PID:3624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IO/Operational
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-IoTrace/Diagnostic
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Analytic
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-LiveDump/Operational
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Memory/Analytic
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Network/Analytic
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Pdc/Diagnostic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Pep/Diagnostic
  2⤵
  PID:4092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
  2⤵
  PID:4988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-PnP/Configuration
  2⤵
  - Clears Windows event logs
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
  2⤵
  PID:636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
  2⤵
  PID:2460
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
  2⤵
  PID:4416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Diagnostic
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Diagnostic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Power/Thermal-Operational
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Prefetch/Diagnostic
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Process/Analytic
  2⤵
  PID:1860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Processor-Power/Diagnostic
  2⤵
  PID:4568
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Registry/Analytic
  2⤵
  PID:4764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-Registry/Performance
  2⤵
  PID:2364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Debug
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Diagnostic
  2⤵
  PID:1048
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-ShimEngine/Operational
  2⤵
  PID:1828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Analytic
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-StoreMgr/Operational
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Analytic
  2⤵
  PID:1112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Debug
  2⤵
  PID:812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WDI/Operational
  2⤵
  PID:888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Errors
  2⤵
  PID:876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-WHEA/Operational
  2⤵
  PID:3720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Kernel-XDV/Analytic
  2⤵
  PID:440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Admin
  2⤵
  PID:652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Operational
  2⤵
  PID:4004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-KeyboardFilter/Performance
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-Known Folders API Service"
  2⤵
  PID:4164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-L2NA/Diagnostic
  2⤵
  PID:3100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LDAP-Client/Debug
  2⤵
  PID:3648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Diagnostic
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Operational
  2⤵
  PID:2368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LSA/Performance
  2⤵
  PID:2520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LUA-ConsentUI/Diagnostic
  2⤵
  PID:2084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Analytic
  2⤵
  - Clears Windows event logs
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Debug
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LanguagePackSetup/Operational
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LimitsManagement/Diagnostic
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic
  2⤵
  PID:4136
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational
  2⤵
  PID:1804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Analytic
  2⤵
  PID:2344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-LiveId/Operational
  2⤵
  PID:4016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic
  2⤵
  PID:764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-CLNT/Diagnostic
  2⤵
  PID:1600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-DRV/Diagnostic
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MPS-SRV/Diagnostic
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSFTEDIT/Diagnostic
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Admin
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Debug
  2⤵
  PID:5088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MSPaint/Diagnostic
  2⤵
  PID:2604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Admin
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Analytic
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Debug
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MUI/Operational
  2⤵
  PID:1168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/DMC
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/DMR
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Media-Streaming/MDE
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-MFReadWrite/Transform
  2⤵
  PID:1820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-Performance/SARStreamResource
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MediaFoundation-PlayAPI/Analytic
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MemoryDiagnostics-Results/Debug
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Minstore/Analytic
  2⤵
  PID:2284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Minstore/Debug
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic
  2⤵
  PID:324
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational
  2⤵
  PID:2940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-MobilityCenter/Performance
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin
  2⤵
  PID:4948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug
  2⤵
  PID:1840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Mprddm/Operational
  2⤵
  PID:4176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Analytic
  2⤵
  - Clears Windows event logs
  PID:464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NCSI/Operational
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDF-HelperClassDiscovery/Debug
  2⤵
  PID:1420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS-PacketCapture/Diagnostic
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Diagnostic
  2⤵
  PID:868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NDIS/Operational
  2⤵
  - Clears Windows event logs
  PID:4600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NTLM/Operational
  2⤵
  PID:336
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NWiFi/Diagnostic
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Narrator/Diagnostic
  2⤵
  PID:4168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ncasvc/Operational
  2⤵
  PID:4500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Diagnostic
  2⤵
  PID:3580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NcdAutoSetup/Operational
  2⤵
  PID:1256
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NdisImPlatform/Operational
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ndu/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetShell/Performance
  2⤵
  PID:4960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-Connection-Broker
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-DataUsage/Analytic
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-Setup/Diagnostic
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Network-and-Sharing-Center/Diagnostic
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkBridge/Diagnostic
  2⤵
  PID:3756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkLocationWizard/Operational
  2⤵
  PID:1580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Diagnostic
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProfile/Operational
  2⤵
  PID:3800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvider/Operational
  2⤵
  PID:1332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Analytic
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkProvisioning/Operational
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkSecurity/Debug
  2⤵
  PID:2512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NetworkStatus/Analytic
  2⤵
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Networking-Correlation/Diagnostic
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Networking-RealTimeCommunication/Tracing
  2⤵
  - System Time Discovery
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Diagnostic
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-NlaSvc/Operational
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Operational
  2⤵
  PID:4564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/Performance
  2⤵
  PID:1152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ntfs/WHC
  2⤵
  PID:4056
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLE/Clipboard-Performance
  2⤵
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLEACC/Debug
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OLEACC/Diagnostic
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic
  2⤵
  PID:1972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-Core/Diagnostic
  2⤵
  PID:2016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Diagnostic
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-DUI/Operational
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OcpUpdateAgent/Operational
  2⤵
  PID:1096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Analytic
  2⤵
  PID:1748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Debug
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/Operational
  2⤵
  PID:2176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OfflineFiles/SyncLog
  2⤵
  PID:220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneBackup/Debug
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Diagnostic
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OneX/Operational
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OobeLdr/Analytic
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-OtpCredentialProvider/Operational
  2⤵
  PID:1108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PCI/Diagnostic
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Analytic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Debug
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PackageStateRoaming/Operational
  2⤵
  PID:4988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ParentalControls/Operational
  2⤵
  PID:3308
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Analytic
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Partition/Diagnostic
  2⤵
  PID:656
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionRuntime/Operational
  2⤵
  PID:4416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PerceptionSensorDataService/Operational
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Analytic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic
  2⤵
  PID:1956
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-Nvdimm/Operational
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Analytic
  2⤵
  PID:1860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic
  2⤵
  PID:3304
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-PmemDisk/Operational
  2⤵
  PID:4764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Analytic
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Certification
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Diagnose
  2⤵
  PID:1048
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PersistentMemory-ScmBus/Operational
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PhotoAcq/Analytic
  2⤵
  PID:3260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PlayToManager/Analytic
  2⤵
  PID:112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Analytic
  2⤵
  PID:1224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Policy/Operational
  2⤵
  PID:1112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PortableDeviceStatusProvider/Analytic
  2⤵
  PID:812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PortableDeviceSyncProvider/Analytic
  2⤵
  PID:888
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Power-Meter-Polling/Diagnostic
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerCfg/Diagnostic
  2⤵
  - Power Settings
  PID:3720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerCpl/Diagnostic
  2⤵
  PID:440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic
  2⤵
  PID:652
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic
  2⤵
  PID:2848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational
  2⤵
  PID:4164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Admin
  2⤵
  PID:4828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Analytic
  2⤵
  PID:3648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Debug
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PowerShell/Operational
  2⤵
  PID:2368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrimaryNetworkIcon/Performance
  2⤵
  PID:2520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintBRM/Admin
  2⤵
  PID:2084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService-USBMon/Debug
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Admin
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Debug
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PrintService/Operational
  2⤵
  PID:4120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Privacy-Auditing/Operational
  2⤵
  PID:4136
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ProcessStateManager/Diagnostic
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/Analytic
  2⤵
  - Clears Windows event logs
  PID:4156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin
  2⤵
  PID:764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot
  2⤵
  PID:1600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Diagnostic
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Informational
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Proximity-Common/Performance
  2⤵
  PID:5088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Developer/Debug
  2⤵
  PID:2604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-InProc/Debug
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Admin
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Debug
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-PushNotification-Platform/Operational
  2⤵
  PID:1168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-QoS-Pacer/Diagnostic
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-QoS-qWAVE/Debug
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC-Proxy/Debug
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC/Debug
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RPC/EEInfo
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Debug
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RRAS/Operational
  2⤵
  PID:1820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RadioManager/Analytic
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Debug
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RasAgileVpn/Operational
  2⤵
  PID:2284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReFS/Operational
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Analytic
  2⤵
  PID:3368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoost/Operational
  2⤵
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Analytic
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ReadyBoostDriver/Operational
  2⤵
  PID:2940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Regsvr32/Operational
  2⤵
  PID:4488
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
  2⤵
  PID:4948
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Admin
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Operational
  2⤵
  PID:1840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteAssistance/Tracing
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin
  2⤵
  PID:4176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug
  2⤵
  PID:464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin
  2⤵
  PID:1420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug
  2⤵
  PID:868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Diagnostic
  2⤵
  PID:4160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Remotefs-Rdbss/Operational
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ResetEng-Trace/Diagnostic
  2⤵
  PID:1224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Detector/Operational
  2⤵
  PID:4168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Resource-Exhaustion-Resolver/Operational
  2⤵
  PID:4500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ResourcePublication/Tracing
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RestartManager/Operational
  2⤵
  PID:1256
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Admin
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-RetailDemo/Operational
  2⤵
  PID:232
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Graphics/Analytic
  2⤵
  PID:4960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Networking/Tracing
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Web-Http/Tracing
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-WebAPI/Tracing
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource
  2⤵
  PID:3756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine
  2⤵
  PID:1580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime/CreateInstance
  2⤵
  PID:2084
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Runtime/Error
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Analytic
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/HelperClassDiagnostic
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/ObjectStateDiagnostic
  2⤵
  PID:4120
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBClient/Operational
  2⤵
  PID:4136
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Admin
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Debug
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBDirect/Netmon
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Analytic
  2⤵
  PID:764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Audit
  2⤵
  PID:1600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Connectivity
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:2432
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Operational
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Performance
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBServer/Security
  2⤵
  PID:5088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Admin
  2⤵
  PID:2604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SMBWitnessClient/Informational
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SPB-ClassExtension/Analytic
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SPB-HIDI2C/Analytic
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Schannel-Events/Perf
  2⤵
  PID:1168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdbus/Analytic
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdbus/Debug
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sdstor/Analytic
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Search-Core/Diagnostic
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Search-ProtocolHandlers/Diagnostic
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Diagnostic
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SearchUI/Operational
  2⤵
  PID:1820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecureAssessment/Operational
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Adminless/Operational
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Audit-Configuration-Client/Operational
  2⤵
  PID:2284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational
  2⤵
  PID:3368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityListener/Operational
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-IdentityStore/Performance
  2⤵
  PID:2860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational
  2⤵
  PID:512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/KernelMode
  2⤵
  PID:744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Mitigations/UserMode
  2⤵
  PID:3016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Netlogon/Operational
  2⤵
  - Clears Windows event logs
  PID:1736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GC/Analytic
  2⤵
  PID:808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational
  2⤵
  PID:2728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP-UX/Analytic
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-SPP/Perf
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-UserConsentVerifier/Audit
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Security-Vault/Performance
  2⤵
  PID:1828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Admin
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Operational
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SecurityMitigationsBroker/Perf
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SendTo/Diagnostic
  2⤵
  PID:4876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sens/Debug
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sensors/Debug
  2⤵
  PID:3580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sensors/Performance
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Serial-ClassExtension-V2/Analytic
  2⤵
  PID:5092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Serial-ClassExtension/Analytic
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ServiceReportingApi/Debug
  2⤵
  PID:3408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Services-Svchost/Diagnostic
  2⤵
  PID:1516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Services/Diagnostic
  2⤵
  PID:4556
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Servicing/Debug
  2⤵
  PID:3100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Debug
  2⤵
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-Azure/Operational
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Analytic
  2⤵
  PID:3288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Debug
  2⤵
  PID:728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync-OneDrive/Operational
  2⤵
  PID:3800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Analytic
  2⤵
  - Clears Windows event logs
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Debug
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/Operational
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SettingSync/VerboseDebug
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Setup/Analytic
  2⤵
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupCl/Analytic
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupPlatform/Analytic
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupQueue/Analytic
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SetupUGC/Analytic
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AppWizCpl/Diagnostic
  2⤵
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Common/Diagnostic
  2⤵
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic
  2⤵
  PID:1972
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic
  2⤵
  PID:2016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/ActionCenter
  2⤵
  PID:536
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/AppDefaults
  2⤵
  PID:1096
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Diagnostic
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/LogonTasksChannel
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Core/Operational
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-DefaultPrograms/Diagnostic
  2⤵
  PID:220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-LockScreenContent/Diagnostic
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-OpenWith/Diagnostic
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-Shwebsvc
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shell-ZipFolder/Diagnostic
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic
  2⤵
  PID:1108
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Shsvcs/Diagnostic
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SleepStudy/Diagnostic
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-Audit/Authentication
  2⤵
  PID:4988
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-DeviceEnum/Operational
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmartScreen/Debug
  2⤵
  PID:3312
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Audit
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Connectivity
  2⤵
  PID:4364
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Diagnostic
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SmbClient/Security
  2⤵
  PID:1840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Speech-UserExperience/Diagnostic
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Spell-Checking/Analytic
  2⤵
  PID:4176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SpellChecker/Analytic
  2⤵
  PID:464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Spellchecking-Host/Analytic
  2⤵
  PID:4764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SruMon/Diagnostic
  2⤵
  PID:1420
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SrumTelemetry
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Debug
  2⤵
  - Clears Windows event logs
  PID:868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Diagnostic
  2⤵
  PID:224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Operational
  2⤵
  PID:4160
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StateRepository/Restricted
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorDiag/Operational
  2⤵
  PID:1332
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorPort/Operational
  2⤵
  PID:4876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Admin
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Analytic
  2⤵
  PID:3580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Debug
  2⤵
  PID:4528
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Diagnose
  2⤵
  PID:5092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ATAPort/Operational
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Admin
  2⤵
  PID:3408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Analytic
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Debug
  2⤵
  PID:1516
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Diagnose
  2⤵
  PID:3100
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-ClassPnP/Operational
  2⤵
  PID:3744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Admin
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Analytic
  2⤵
  PID:3288
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Debug
  2⤵
  PID:728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Diagnose
  2⤵
  - Clears Windows event logs
  PID:3800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Disk/Operational
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Admin
  2⤵
  - Clears Windows event logs
  PID:996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Analytic
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Debug
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Diagnose
  2⤵
  PID:412
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Health
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Storport/Operational
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering-IoHeat/Heat
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storage-Tiering/Admin
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Debug
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageManagement/Operational
  2⤵
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSettings/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:1700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Diagnostic
  2⤵
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Operational
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-Driver/Performance
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-ManagementAgent/WHC
  2⤵
  PID:5088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic
  2⤵
  PID:2604
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-StorageSpaces-SpaceManager/Operational
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Store/Operational
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Storsvc/Diagnostic
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Subsys-Csr/Operational
  2⤵
  PID:1168
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Subsys-SMSS/Operational
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/Main
  2⤵
  PID:2176
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/PfApLog
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Superfetch/StoreLog
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysmon/Operational
  2⤵
  PID:4060
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Sysprep/Analytic
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-System-Profile-HardwareId/Diagnostic
  2⤵
  PID:3320
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsHandlers/Debug
  2⤵
  PID:3272
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Debug
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Diagnostic
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-SystemSettingsThreshold/Operational
  2⤵
  PID:3548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Diagnostic
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TCPIP/Operational
  2⤵
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msctf/Debug
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msctf/Diagnostic
  2⤵
  PID:2940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msutb/Debug
  2⤵
  PID:1092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TSF-msutb/Diagnostic
  2⤵
  PID:4416
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TTS/Diagnostic
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinAPI/Diagnostic
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Diagnostic
  2⤵
  PID:680
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TWinUI/Operational
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Analytic
  2⤵
  PID:1860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZSync/Operational
  2⤵
  PID:3304
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TZUtil/Operational
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Debug
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Diagnostic
  2⤵
  PID:4788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Maintenance
  2⤵
  - Clears Windows event logs
  PID:4600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskScheduler/Operational
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TaskbarCPL/Diagnostic
  2⤵
  PID:3840
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic
  2⤵
  PID:112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational
  2⤵
  PID:876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Admin
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Debug
  2⤵
  - Clears Windows event logs
  PID:4620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
  2⤵
  PID:440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-MediaRedirection/Analytic
  2⤵
  PID:4960
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Admin
  2⤵
  PID:2848
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Analytic
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Debug
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-PnPDevices/Operational
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Admin
  2⤵
  PID:3648
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Analytic
  2⤵
  PID:1580
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Debug
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-Printers/Operational
  2⤵
  PID:1560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Analytic
  2⤵
  PID:1220
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Debug
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RDPClient/Operational
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback
  2⤵
  PID:1928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin
  2⤵
  PID:2344
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug
  2⤵
  PID:2564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
  2⤵
  PID:4564
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin
  2⤵
  PID:764
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic
  2⤵
  PID:1600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Tethering-Manager/Analytic
  2⤵
  PID:2484
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Tethering-Station/Analytic
  2⤵
  PID:1496
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ThemeCPL/Diagnostic
  2⤵
  PID:2016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-ThemeUI/Diagnostic
  2⤵
  - Clears Windows event logs
  PID:4260
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Threat-Intelligence/Analytic
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational
  2⤵
  PID:3088
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Time-Service/Operational
  2⤵
  PID:4696
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Admin
  2⤵
  PID:2788
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Troubleshooting-Recommended/Operational
  2⤵
  PID:1748
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-TunnelDriver
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC-FileVirtualization/Operational
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UAC/Operational
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UI-Shell/Diagnostic
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAnimation/Diagnostic
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Debug
  2⤵
  PID:1820
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Diagnostic
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIAutomationCore/Perf
  2⤵
  - Clears Windows event logs
  PID:3908
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UIRibbon/Diagnostic
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-MAUSBHOST-Analytic
  2⤵
  PID:2284
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-UCX-Analytic
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBHUB/Diagnostic
  2⤵
  PID:3368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBHUB3-Analytic
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBPORT/Diagnostic
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBXHCI-Analytic
  2⤵
  PID:2860
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic
  2⤵
  - Clears Windows event logs
  PID:512
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UniversalTelemetryClient/Operational
  2⤵
  PID:744
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
  2⤵
  PID:3016
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
  2⤵
  PID:1736
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Diagnostic"
  2⤵
  PID:808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Control Panel/Operational"
  2⤵
  PID:2728
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Admin"
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Device Registration/Debug"
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Diagnostic"
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl "Microsoft-Windows-User Profile Service/Operational"
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Analytic
  2⤵
  PID:1828
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-User-Loader/Operational
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserAccountControl/Diagnostic
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserModePowerService/Diagnostic
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/ActionCenter
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceInstall
  2⤵
  - Clears Windows event logs
  PID:1112
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/DeviceMetadata/Debug
  2⤵
  PID:812
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/Performance
  2⤵
  PID:4504
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UserPnp/SchedulerOperations
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UxInit/Diagnostic
  2⤵
  PID:968
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-UxTheme/Diagnostic
  2⤵
  PID:4004
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VAN/Diagnostic
  2⤵
  PID:1440
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VDRVROOT/Operational
  2⤵
  PID:3204
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Analytic
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VHDMP-Operational
  2⤵
  PID:4164
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VIRTDISK-Analytic
  2⤵
  PID:448
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN-Client/Operational
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VPN/Operational
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VWiFi/Diagnostic
  2⤵
  PID:2368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Admin
  2⤵
  PID:4708
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VerifyHardwareSecurity/Operational
  2⤵
  PID:2520
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-Volume/Diagnostic
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeControl/Performance
  2⤵
  PID:756
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Analytic
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-VolumeSnapshot-Driver/Operational
  2⤵
  PID:1804
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WABSyncProvider/Analytic
  2⤵
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WCN-Config-Registrar/Diagnostic
  2⤵
  PID:1524
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WCNWiz/Analytic
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WEPHOSTSVC/Operational
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WER-PayloadHealth/Operational
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Analytic
  2⤵
  PID:1152
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WFP/Operational
  2⤵
  PID:1924
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-AutoConfig/Operational
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-Autoconfig/Diagnostic
  2⤵
  PID:1368
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-Driver/Analytic
  2⤵
  PID:3264
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLAN-MediaManager/Diagnostic
  2⤵
  PID:4128
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WLANConnectionFlow/Diagnostic
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Debug
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Operational
  2⤵
  PID:4464
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMI-Activity/Trace
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPDMCUI/Diagnostic
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Diagnostic
  2⤵
  PID:3624
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSS-Service/Operational
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WMPNSSUI/Diagnostic
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-API/Analytic
  2⤵
  PID:548
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Analytic
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-ClassInstaller/Operational
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Analytic
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-CompositeClassDriver/Operational
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPBT/Analytic
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Analytic
  2⤵
  PID:4092
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPClassDriver/Operational
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPIP/Analytic
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WPD-MTPUS/Analytic
  2⤵
  PID:636
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WSC-SRV/Diagnostic
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WUSA/Debug
  2⤵
  PID:3208
- C:\Windows\system32\wevtutil.exe
  "C:\Windows\system32\wevtutil.exe" cl Microsoft-Windows-WWAN-CFE/Diagnostic
  2⤵
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a1a5cd54a073fcc6f996c5bf8eae9ab4

SHA1
f51b3b1fe5ec1ace8641c99d2769a0f9f93f640f

SHA256
d0cc04ed0b546b1d7f405da38b5c1addd1fbc26591027e76b9745a9c1daf584e

SHA512
6804bc8a338f7727396b107ee58e418dae2c086aa85c8edb4d4a90f7398963dc63bab06574ed8b3c593e76d7740ecacec63d1643c6f26058a5d947caafb7673c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
929c856a9f5f4fd187b9b324e39be583

SHA1
b5d74d5b632f2b0d892c0b763f7f9c36f8677fec

SHA256
67fc49d5d72ee25add82821193e326f1109d7b88189560492686a8f9d8b6c97e

SHA512
5746885b047af646bee26dc965c2fea100c395b2cc89a868af5d5858dd273497c3ea2f567c11439a84502cceea001a661352b8d0873c2cf09b1697c583fc61dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\3rbgjydh\3rbgjydh.dll

Filesize
3KB

MD5
e6e6865b105aa8024ae770154871ebe4

SHA1
85d29ce3c40a8320ab45d7e0137899425b5c6c3b

SHA256
999bf6c296f9d7b6aed8c85119edf7d1e5806b764c37a70b95075844a1d41d7e

SHA512
76b45a6babc19acc0ad4ea617c10e1989da176223e3d5d9ac427d77869fa09ab0c90a8d63ea75a2dd7dbc41197be42998ef29890522b826ba42e85a95e92a5cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\3wmimtnf\3wmimtnf.dll

Filesize
3KB

MD5
d3e1b5f4c1059e312aa9db76b8f1cf3b

SHA1
4a96add418d6588f768c6ea902cbf090e36e3b10

SHA256
371272d94241e913e31a4f9573a92217bd014f7655b86f11aa426184eb03f669

SHA512
de77080845ba2e9f1af71d3739fc94b43745f739e0751f88755bd348f10ac2be12d4bb2515018a09714cedec97e2fc1bf101c998db3814066473b7dd82bd5528

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES27D6.tmp

Filesize
1KB

MD5
e0fc7b490281bf080e497367852923aa

SHA1
58c03bf9d06f0be0206308375e49c76623d762b7

SHA256
57045b560504b7fa940837b38ba3d4b49501b0aadd360edea0f258136f9a2745

SHA512
4ae3206fee5a49858ca130079ec43fdfe25413ce5ebf3f047e90916276eb73170a1de9090e6f9d0a70cc2c3bb4f9dbad39d0acc5fa53322de7a2a924e74aa3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2A86.tmp

Filesize
1KB

MD5
20956d83f92b9d373a541324c34c811e

SHA1
aa77f20e4e060b076ff68705441dff2eb9076a7b

SHA256
c62f017331e0419c4d5fa8df3a3482f879ab7c53bc6823dd82df51894704e28e

SHA512
0cab11aa689a6b872f7f5542c1ca4af856e4686a27bdc55614a316b74972e8fe24c4b84887675d8dea55850dd0a922ab6e5ec3f1e422ca18e1f65adbe454b201

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2AC4.tmp

Filesize
1KB

MD5
04285d3d1530376cf8797d59b8c749f4

SHA1
b1fe37d33d362a58bf3c51ff39288259158b67bd

SHA256
81c7c53466ba81fa4da9beccab8423f2cce20eded1a34b948ff562f0e9f6b30a

SHA512
cfd43d7606f49e0101b91011ee5f941917d304eb42be307f1b8bca9b70766eb258dfd3760bbecd43a26054ab9e36885f7c1587f0b53123c32479b9625ebc0b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES30EE.tmp

Filesize
1KB

MD5
dc3374ddc3ed771dd3ddb1477d11b620

SHA1
0058f497737e7f4f7790e3a14473d86a15af9ad4

SHA256
4b002de716dcf14786a741d2503a128103c1c34c7756f40e345b8ba22f4b5163

SHA512
8fa07757816677a7d3b308cbfdbdc5248c851eac9190de6faeed98e9ecdbce4b985d46006d3159e602be98997ac0597d8b66bd276e4afccff47f6e9f4afa8400

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA19F.tmp

Filesize
1KB

MD5
ecdda7e3a909525891e64881cd940c76

SHA1
a4eb8be32600b92e9642618c3d17bc78e1738ba4

SHA256
2a8587425a48ec1d1e71ce944e25d36c645b5253e3adc3dee73b169f30328376

SHA512
353ec5fc8a867f978bc7ef6e4a4c05b58f5f22c43a98ca2fd8efc0ad1cf56e55b318892627835a243fa08c698d7c4711d86a7e206820d8e52e70a65066bf828b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBF2.tmp

Filesize
1KB

MD5
0c6bd1bd9523a704b2ed199668f8ffd0

SHA1
1466c8b363b41ac9923fd6490b756439de59cf79

SHA256
2dd6d704699fc6ac81678617a5cd6fc064994a4941f730d05d03b93779ba8d03

SHA512
743d685744c2371c930e668463019d6e3136bf95c3918491181d0431f3b681ace9343f6d390b97d43d88412c655d7387eb8dd2b72e4e38c51e0341c5cc6cd93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3nohjowy.u3l.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdj5jytk\fdj5jytk.dll

Filesize
3KB

MD5
16ac53849f473707ab3df8c190c4d60b

SHA1
a75facf80512aef0a9cfa76c28256e4fdb61c87e

SHA256
00e33f3e11baf439b6f7155e815346d7a92c469c213412d60c6c06d833701da4

SHA512
4d7533d57c0750f237b027f2f4644ca266c44c8a1364c1b766bae3129707694e3903c173d3b04c5812d4352e7ee95b10d10e318d7cb402163db7399b025fc9f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\kkt0qi0r\kkt0qi0r.dll

Filesize
3KB

MD5
475dd2c35139b0b3b7449b615621e6f0

SHA1
d0d6a3017985247f630e25d7061461f34ee1407c

SHA256
712b51a31635f0a6d31a35728a0a8b4de6228e97e3f02ec8e39494b7b962f0d4

SHA512
128d4799bfa1b01877d4a01361a2be93117e806d670e40237d0c4bed92152bfb5525f3c6d45a0663cb219db1e0f0d4a6dd96ea5b1bd46a192044bfddb3feaa50

Download Submit
C:\Users\Admin\AppData\Local\Temp\mtlva3hv\mtlva3hv.dll

Filesize
3KB

MD5
6c4b5b0cbe86947f1cef46d0a7e89862

SHA1
aeee07c7df43031ced93a45fa8e780d5d0bfbaab

SHA256
5d621899defbeeb3bc14b73e78966bed1d98332da07ef3184370337fb43cc831

SHA512
7a5c4cffcf8656fc3a033a1d535dec639ddcc62675c2983bb44882fdd51f79a5754f22fed19122c58b1f3d92ee698a4e9a79b125c61300c4ca4732ef8ba9828d

Download Submit
C:\Users\Admin\AppData\Local\Temp\z5vn1nbo\z5vn1nbo.dll

Filesize
3KB

MD5
cb1355c6c139b685cc882d09a329a95e

SHA1
aa9b22d46b4e7957c3bc23b90416933356feeccf

SHA256
5ef146c41359a1255ff233eca31e3d2f95147e85470f2573b39d1ca679f415ea

SHA512
e6f858560d77afb50cb8ddcf177208f63fc2df8b1ed3bec37234cf0f54736d024b2a90b1c006e2e2512662d133491ebcd45a53fc4d1c5f23345eb16e67c7d868

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1015B

MD5
87bae8c52fcff57f9c0575e78c50ccb9

SHA1
a47a606df8a0b5a459565400450dae0b9d02829c

SHA256
df6bf61b3168b57add00ad985a94be119dc545633fa013e5233bce795b80896e

SHA512
3ddd9b306590b48e9fa4c82ba5f1d8dcffdd8fcd5288eb85e379effccd54e4a88776a35ce964cbb75e76fe01f708d00608b36af85860c2ed5f78fddd26af2da1

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
bceddb758fd59d486a4421d456e13ffe

SHA1
f3fbfde326a17938788616f87b62e0d34df61dcb

SHA256
782479f587eddf0bdc9eb0ddc52e2733301815420b9fce40ccb0e26e5bc9403f

SHA512
87e00eafca41d3efaf6e014b3c09e6a78c86abc1701970aa02cf46849d7e0c6a6a5c26d769d79e218291813bcb42f33eee36d92ef19a029eeee003719e869023

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
e81d8827f82a8251a222f78b47b0ad73

SHA1
633a173cf6b0776bad6cde325370a3e952f9b880

SHA256
49883b08cd5e0e1bab9d140c59ec9114037af13d41be3bfb818e672eed68a0c5

SHA512
f9e9fd5dde717a37ef4c660b65e155804c75fd769732cbba90210f023a2c6b63f0c3e2111e4c7531415e146e620f446c927cb833d653e0e85a806922c91a2cdf

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
80b61ee283896b68a83b432c61a8cd5a

SHA1
1757a8ca178ac87167362d22107a68a1b24fbb9d

SHA256
6d2ed5dbf897d632e404fcd108185c26058318cedc1a083ea1794b4ed3f778f8

SHA512
045bee90549eb6457177cc0fcaef9af662fb1c5988a777c034d59df78791e3f07c826f7cc01f39c3dbc98ac3fbda142485a9707ba1fcd6b7c98f750eca138e01

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
1KB

MD5
1624476f17d72be799d6d98b96210d9d

SHA1
4e2d341735fb484c46c43866fe1a780fda7dbb9f

SHA256
cd00c6e514959c787c9efa82f117a4d446b5eb47f6982801356de6221e1ed292

SHA512
a28ceb4741ae09c8df7654aa10b37a14f872663ad00951ce4930a301ea288c526adb74a5ce7bbd94a55ef728d27bba0f1103a580a9b051a7e023157fed0f2a5e

Download Submit
C:\Users\Admin\Desktop\ChaosLog.txt

Filesize
2KB

MD5
dc09263bbf4a7a103c617401515cb8a8

SHA1
b930ffd7221c19a4f8b54f21a504d09726dd6401

SHA256
170466bf0927396e151779cb79addc27ffa2d9654380479145ed42b91b703527

SHA512
fbdd5ff2418c05f78ea5f613bbbec472bf90b8cbed8ba7f87c2ed090f7a846e77afac4efe3b05cebd2ede491f9ed3f41bc08f2500c0da28aa4d450102d3e8350

Download Submit
C:\Windows\System32\AlertAleph-mNbZXBtE.ps1

Filesize
34KB

MD5
1ff55d58db5098bc348b64c56f7e5275

SHA1
042a98b432daff9e99a5af37e748b4b2d66ee763

SHA256
bbcfe2f3c7c1253bc2fea8f858cf887b36c363ed90a3160b6cf19ee2b5a9acbd

SHA512
8e7a5dc1d9d642e0370f778efc57e378bf29d4140414fe5f4ce85345202e6e5cd397aeab1376ab3887da1abce5d72ca2b4b7fe4a35afb1637ffbd890435b0f58

Download Submit
C:\Windows\Temp\ArataProtect-mNbZXBtE.ps1

Filesize
649B

MD5
2db4cf8026ce4799519eb559f3a9bf54

SHA1
688ab9b24123edc26fe43cbfd08799d838b67f62

SHA256
7913bfe892a2568e7d21c46cedc877a57be753fb8b5dbb512425e405e483127c

SHA512
e95a82ac85acd9ef05e7ac6e26f5d480a4f2d68deac78394a564edc13a39561d52e9187f79e78793c2dd56c8d61dca9d9ff9a6b62634107fa4d914cca0966e6e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3rbgjydh\3rbgjydh.cmdline

Filesize
369B

MD5
812e83fbdb1452106f821d5e4f02b1d9

SHA1
4893c2e874e9cd9e5afc6984d399f92bc9de6324

SHA256
b5c0854f432798e7fd5689e1c280a6fb853dd90adb8f89657d7561ee4977889c

SHA512
13b0d2cd257c7baa56427f74148edf5427c52de1a31a33a744484bbed6f35bb835e539f6cb6f0fafd7dc4111d02d08fd09bc4da6223449feb827ffe10ee93256

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3rbgjydh\CSCD2A3C0ECA65143F98AF2AEF7CA6DA857.TMP

Filesize
652B

MD5
dccde86c26fe7c6361bb0b21d5288689

SHA1
032a1d27ae8b282be93811caf2a3f6365afddc05

SHA256
81f61df61e4a9a3af23414072fa9bb0ca89defe8bc8b8528485325c080f5098a

SHA512
914f7ffc26e0bf7cf8ee48b298855b26240629565730bb4981f5b755d33e4399b08b0ea37066f98c9b57c2744f12ed2271f0cd730fd2ae9193221fdf468c05dd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3wmimtnf\3wmimtnf.cmdline

Filesize
369B

MD5
8d8182342d3bd3b4f206668984162a0b

SHA1
fe564ad756971694538b3f6a08384b62fe8e02da

SHA256
2bd27e6bfde63dbad2326467cd035e6d0309efd8867541324db9b8c8e196ab08

SHA512
c2e82b21ba09d283a981419e78184682892ac53ee98f825c4df7e5279686d17ca47d8b2813d0561a28a1d9d8cfb1cea22c9da36748d6ef6901679a622e567555

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3wmimtnf\CSC590D46C52F9742EDB287A04BCD8B2A8F.TMP

Filesize
652B

MD5
bb18e719c58d191790c21dc625e7fd99

SHA1
0e36dd79839e60608abf03ae6d56fbd85d535d85

SHA256
631bfd1912608d005106e73a0f3eb202ea5ee88551e4b8e1c90a43492604c9d2

SHA512
c46101666e98451e6242917e4c38a37497170dd549bdb452a5a76b3019e082a5750a7d1ebc426861ea187683d14a0079d2904df131ac970e7fe795df471f177b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdj5jytk\CSCEEEB84546DC0496BB34969C18822F27.TMP

Filesize
652B

MD5
71f2bbd7895b289a2ed3750d5f28e02a

SHA1
1b8c1e15e9cf9232b67b66387ecd9c56ae1ce1f7

SHA256
5183349c72e594075400b854ec9fb4792698cad6eb14af146ed597346bae5117

SHA512
bd51464eb8ed982aaf7420b2d58c17fc227efb361f711f8ba15717e8743b88c59e7e5f8edb8862b2c316c104db7077f23ac3fce4eb66a115217584b7cf718bdd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdj5jytk\fdj5jytk.cmdline

Filesize
369B

MD5
20c0c41d9748d79c865efcf9f949be4b

SHA1
7da5ab427391e59d87f20c9c0483a35b045e8f07

SHA256
4bb2fa7c48f3c67710fc84574aef6c8e2f8db60c336091857e6bb48ce73050a1

SHA512
2e7a34d1f5bd2a951144ffad28fd2c95e6cdaa945dbfb724288d92e4bd6151fab0f50051469ac9bf86839c2893b1240080858f0c9bc6b15d55f1f6143669307e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kkt0qi0r\CSC7934BDB44A444BE99F49FCD4FA91FF65.TMP

Filesize
652B

MD5
c1c7c9fa3b05f6c24ba73ec9eabae2a3

SHA1
bb5ed618e6ffe196a57c7fa3e6a54eb9efed4022

SHA256
e55dfa25b4f819bfe49fa5d9f0f4486b433dc972710b9f1601c02d68b984d4cb

SHA512
05f465ca4c59d6152414499c81a3410387f18053fa20efa180b72a2c32ac9f5ef7a0083fa7f4008e517604659a98faf4097e54e1433868402167922ebbc1ba45

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kkt0qi0r\kkt0qi0r.0.cs

Filesize
249B

MD5
7df2964601813e20ea90bc7eca64b00b

SHA1
a8ad7c0e81f3b6edd66269283ff1603491edca3b

SHA256
daf8a1ae523190ef51054e143909966e01c3b6f531c72b9524d91254eacd6084

SHA512
4970916854df38bd3e55021c3d4f802b3db5a4d64a4570817edeb8c42d6e335a4e989bfcfdead96c2ee8776cc54ad09ef609090ccd34b849532d5f3f6caf42e0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kkt0qi0r\kkt0qi0r.cmdline

Filesize
369B

MD5
8689bfef73eecfcdbb7b55be034ccf80

SHA1
3280c12f50bd8a77d5edebf41ef5861c18e142e1

SHA256
7110538541ed4dd5c2127c99322ddc2efc995cbc32c2a4027afcf58c29b94316

SHA512
26875b3efb0664da596a6bdfbec71adb1d45b4a22592ee927602c7e664c6fb8b828baee54138ac703a9fb5b35b53e45b7b49434408a84d52087bc0c921663214

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mtlva3hv\CSC895169FC87B4AC68436FD581E7F459.TMP

Filesize
652B

MD5
761415e613fd7f6ae580799bcb32d51c

SHA1
03580dd03fc949acb3ddcb3421a335e7e242e28d

SHA256
8c7a1764e80568910a6b821f903472481c436f3676662c70cb5b0603439b17d3

SHA512
d5aee80327b29f822546de2778826e79101b5c641984c28ba350733a6bbb75f4af5a3bf9a0f78f17de8def66aae5c6f093c72d4dc86414cf9ebf4a6d7e08bae4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mtlva3hv\mtlva3hv.0.cs

Filesize
425B

MD5
bf0bab0ec41a16f88aefa9f29543514d

SHA1
432334393245d6f0c05afc6cd07c99f4eacfaca9

SHA256
2eb1b6bd7727d8842685e02140e0a79c8e99aba04205acd4eb3e51250de5704b

SHA512
dc0c3b44989453ed2f5c8dda5b8a15041e58df27bf39475df904eac1df0ab058c221bf005d7814e30678f121e2b3a6b7c002a0b7be8408e5704a2dbc2e7c4bd0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mtlva3hv\mtlva3hv.cmdline

Filesize
369B

MD5
c69756f7aba5ecd9a9121d4a724ff5b1

SHA1
63426cfb0912d4eef9648bdc2748fe0f45fb8c18

SHA256
7bd9d730d6fc0ff49da4f07ee5380cbbfff7cbb5aace08e1a3adf2c1423c61ae

SHA512
f80aa5fec4bb48fb52f7823a4946eca68eb148e131edfec0427a19704264c29722ccfca12dcf45e69c7f527f95291b93629402beb66e57b2d2349d330b95941f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z5vn1nbo\CSCAA9651197849F698B38383E367E77.TMP

Filesize
652B

MD5
fd66d96e538a1a08018ba164cc29faa6

SHA1
6b76731939cae8f25a6287e552124268d5e18586

SHA256
6c3859b5e02a13809d46c998e17394508b8a6d7122a1b1fef8372a3c1de7b200

SHA512
709a4a5155e12d062dd7ffe3c536aca9b4764127486d1f3cec55c2fcfb14b16caed671f1d6e586b486e88e88534cc45eae8c90e1a02c449561950619fa238e11

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z5vn1nbo\z5vn1nbo.0.cs

Filesize
696B

MD5
b794645974059bd125405f327c5ace77

SHA1
d332d8821d1eee8e5db75ec151df5ec945bec334

SHA256
afd81c914fe8fa7ee32be6a797f46a2a829908b45d59100c1052a7baf2a347da

SHA512
dc8e4aa0b35a02d7f43868bce8602ac3941341f74e2f2de6bb79dbb8eb9372431cd7179f3701a09d574ea449735738d9ba368b78fe4fe7fa6f9856536c19f8f8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z5vn1nbo\z5vn1nbo.cmdline

Filesize
369B

MD5
d9e430aee346901d423b8dc2876e7976

SHA1
d679dcf71c2fc70763ccb6281b78dc3450959d9d

SHA256
5d55c5f1a8745abc84cd54e377e842758317fc96ce8e937e42c293469525d575

SHA512
c065d9814918c9b8f77dc1ccdf30401df2eff386a26f79b1e50e18cb8ce8005f5c98c88c1c6b0332bab7fc061a8818a8bfdbb55424c373a2222353c88cb82c1e

Download Submit
memory/820-141-0x00000193920A0000-0x00000193920A8000-memory.dmp

Filesize
32KB

Download
memory/1820-174-0x0000019D6C8D0000-0x0000019D6C8D8000-memory.dmp

Filesize
32KB

Download
memory/2508-32-0x00007FFC3B080000-0x00007FFC3BB41000-memory.dmp

Filesize
10.8MB

Download
memory/2508-0-0x00007FFC3B083000-0x00007FFC3B085000-memory.dmp

Filesize
8KB

Download
memory/2508-25-0x00000213B5500000-0x00000213B5508000-memory.dmp

Filesize
32KB

Download
memory/2508-12-0x00007FFC3B080000-0x00007FFC3BB41000-memory.dmp

Filesize
10.8MB

Download
memory/2508-30-0x00007FFC3B083000-0x00007FFC3B085000-memory.dmp

Filesize
8KB

Download
memory/2508-11-0x00007FFC3B080000-0x00007FFC3BB41000-memory.dmp

Filesize
10.8MB

Download
memory/2508-31-0x00007FFC3B080000-0x00007FFC3BB41000-memory.dmp

Filesize
10.8MB

Download
memory/2508-10-0x00000213B5530000-0x00000213B5552000-memory.dmp

Filesize
136KB

Download
memory/2508-46-0x00000213B5C60000-0x00000213B5C68000-memory.dmp

Filesize
32KB

Download
memory/2508-75-0x00000213B5CF0000-0x00000213B5CF8000-memory.dmp

Filesize
32KB

Download
memory/3368-132-0x00000236FD380000-0x00000236FD388000-memory.dmp

Filesize
32KB

Download