d4b6351e05f553cc1e1f80a91b54657169941047cb68985fcf1778ce10e07cf8

Analysis

user interaction
yes
max time kernel
36s
max time network
34s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Retrac Temp Spoofer(1).exe
Size 30KB
Sample260509-a4664scs8j
SHA256 d4b6351e05f553cc1e1f80a91b54657169941047cb68985fcf1778ce10e07cf8
MD5 8c0bf150994081bf478e238acf25dec9
SHA1 bea65477f00b3a892ef0f630a5cba0e83f07b520
SHA512 fe418230676ca241bd274b9d64c5e5133b59f95deb98dae8d58a7410c44c3277cced5550336b8568aca8662b63733404642a142e879e1e6fd8a5fccf33da563b
SSDEEP 384:6Y9coruNd0Snu755QP+hNCe4bKXXXTcJAgN3haUV75ZBgawVbXlppqFyoghXRQmy:94u755u+WKUpBQppOfH18SCt4IVtT3i
TLSH
T100E25B6A735644ECD167A2F9C5772907E771B8090B32CADF33D805AD1FA72C09D7AA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3460	wevtutil.exe
1828	wevtutil.exe
5740	wevtutil.exe
2084	wevtutil.exe
4948	wevtutil.exe
3576	wevtutil.exe
3636	wevtutil.exe
2388	wevtutil.exe
5220	wevtutil.exe
3208	wevtutil.exe
5588	wevtutil.exe
3052	wevtutil.exe
1244	wevtutil.exe
1056	wevtutil.exe
660	wevtutil.exe
4168	wevtutil.exe
4868	wevtutil.exe
3064	wevtutil.exe
5376	wevtutil.exe
2472	wevtutil.exe
3120	wevtutil.exe
2940	wevtutil.exe
2400	wevtutil.exe
2448	wevtutil.exe
1516	wevtutil.exe
4296	wevtutil.exe
3384	wevtutil.exe
660	wevtutil.exe
5392	wevtutil.exe
596	wevtutil.exe
1564	wevtutil.exe
4404	wevtutil.exe
5480	wevtutil.exe
564	wevtutil.exe
4916	wevtutil.exe
2992	wevtutil.exe
5888	wevtutil.exe
5092	wevtutil.exe
2596	wevtutil.exe
2520	wevtutil.exe
4368	wevtutil.exe
3880	wevtutil.exe
1912	wevtutil.exe
32	wevtutil.exe
2400	wevtutil.exe
4092	wevtutil.exe
5452	wevtutil.exe
5280	wevtutil.exe
984	wevtutil.exe
5632	wevtutil.exe
3684	wevtutil.exe
5432	wevtutil.exe
3116	wevtutil.exe
976	wevtutil.exe
1680	wevtutil.exe
5820	wevtutil.exe
3644	wevtutil.exe
796	wevtutil.exe
5680	wevtutil.exe
5144	wevtutil.exe
4228	wevtutil.exe
5360	wevtutil.exe
3908	wevtutil.exe
2720	wevtutil.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
752	wevtutil.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\retrac_cleaner.bat	Retrac Temp Spoofer(1).exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	wevtutil.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4308	WMIC.exe
Token: SeSecurityPrivilege	4308	WMIC.exe
Token: SeTakeOwnershipPrivilege	4308	WMIC.exe
Token: SeLoadDriverPrivilege	4308	WMIC.exe
Token: SeSystemProfilePrivilege	4308	WMIC.exe
Token: SeSystemtimePrivilege	4308	WMIC.exe
Token: SeProfSingleProcessPrivilege	4308	WMIC.exe
Token: SeIncBasePriorityPrivilege	4308	WMIC.exe
Token: SeCreatePagefilePrivilege	4308	WMIC.exe
Token: SeBackupPrivilege	4308	WMIC.exe
Token: SeRestorePrivilege	4308	WMIC.exe
Token: SeShutdownPrivilege	4308	WMIC.exe
Token: SeDebugPrivilege	4308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4308	WMIC.exe
Token: SeRemoteShutdownPrivilege	4308	WMIC.exe
Token: SeUndockPrivilege	4308	WMIC.exe
Token: SeManageVolumePrivilege	4308	WMIC.exe
Token: 33	4308	WMIC.exe
Token: 34	4308	WMIC.exe
Token: 35	4308	WMIC.exe
Token: 36	4308	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4308	WMIC.exe
Token: SeSecurityPrivilege	4308	WMIC.exe
Token: SeTakeOwnershipPrivilege	4308	WMIC.exe
Token: SeLoadDriverPrivilege	4308	WMIC.exe
Token: SeSystemProfilePrivilege	4308	WMIC.exe
Token: SeSystemtimePrivilege	4308	WMIC.exe
Token: SeProfSingleProcessPrivilege	4308	WMIC.exe
Token: SeIncBasePriorityPrivilege	4308	WMIC.exe
Token: SeCreatePagefilePrivilege	4308	WMIC.exe
Token: SeBackupPrivilege	4308	WMIC.exe
Token: SeRestorePrivilege	4308	WMIC.exe
Token: SeShutdownPrivilege	4308	WMIC.exe
Token: SeDebugPrivilege	4308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4308	WMIC.exe
Token: SeRemoteShutdownPrivilege	4308	WMIC.exe
Token: SeUndockPrivilege	4308	WMIC.exe
Token: SeManageVolumePrivilege	4308	WMIC.exe
Token: 33	4308	WMIC.exe
Token: 34	4308	WMIC.exe
Token: 35	4308	WMIC.exe
Token: 36	4308	WMIC.exe
Token: SeSecurityPrivilege	5316	wevtutil.exe
Token: SeBackupPrivilege	5316	wevtutil.exe
Token: SeSecurityPrivilege	6036	wevtutil.exe
Token: SeBackupPrivilege	6036	wevtutil.exe
Token: SeSecurityPrivilege	5752	wevtutil.exe
Token: SeBackupPrivilege	5752	wevtutil.exe
Token: SeSecurityPrivilege	3780	wevtutil.exe
Token: SeBackupPrivilege	3780	wevtutil.exe
Token: SeSecurityPrivilege	6116	wevtutil.exe
Token: SeBackupPrivilege	6116	wevtutil.exe
Token: SeSecurityPrivilege	2480	wevtutil.exe
Token: SeBackupPrivilege	2480	wevtutil.exe
Token: SeSecurityPrivilege	1056	wevtutil.exe
Token: SeBackupPrivilege	1056	wevtutil.exe
Token: SeSecurityPrivilege	5092	wevtutil.exe
Token: SeBackupPrivilege	5092	wevtutil.exe
Token: SeSecurityPrivilege	4932	wevtutil.exe
Token: SeBackupPrivilege	4932	wevtutil.exe
Token: SeSecurityPrivilege	2720	wevtutil.exe
Token: SeBackupPrivilege	2720	wevtutil.exe
Token: SeSecurityPrivilege	3204	wevtutil.exe
Token: SeBackupPrivilege	3204	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4088	2292	Retrac Temp Spoofer(1).exe	79
PID 2292 wrote to memory of 2192	2292	Retrac Temp Spoofer(1).exe	80
PID 2292 wrote to memory of 6104	2292	Retrac Temp Spoofer(1).exe	81
PID 6104 wrote to memory of 2468	6104	cmd.exe	83
PID 2468 wrote to memory of 3344	2468	net.exe	84
PID 6104 wrote to memory of 3288	6104	cmd.exe	85
PID 6104 wrote to memory of 5144	6104	cmd.exe	86
PID 6104 wrote to memory of 5300	6104	cmd.exe	87
PID 6104 wrote to memory of 4792	6104	cmd.exe	88
PID 6104 wrote to memory of 4252	6104	cmd.exe	89
PID 6104 wrote to memory of 5448	6104	cmd.exe	90
PID 6104 wrote to memory of 5264	6104	cmd.exe	91
PID 5264 wrote to memory of 4308	5264	cmd.exe	92
PID 6104 wrote to memory of 1760	6104	cmd.exe	94
PID 6104 wrote to memory of 5856	6104	cmd.exe	95
PID 6104 wrote to memory of 3240	6104	cmd.exe	96
PID 6104 wrote to memory of 5276	6104	cmd.exe	97
PID 6104 wrote to memory of 2092	6104	cmd.exe	98
PID 6104 wrote to memory of 5636	6104	cmd.exe	99
PID 6104 wrote to memory of 3696	6104	cmd.exe	100
PID 6104 wrote to memory of 2284	6104	cmd.exe	101
PID 6104 wrote to memory of 4460	6104	cmd.exe	102
PID 6104 wrote to memory of 2216	6104	cmd.exe	103
PID 6104 wrote to memory of 5872	6104	cmd.exe	104
PID 6104 wrote to memory of 836	6104	cmd.exe	105
PID 6104 wrote to memory of 1328	6104	cmd.exe	106
PID 6104 wrote to memory of 5216	6104	cmd.exe	107
PID 6104 wrote to memory of 2548	6104	cmd.exe	108
PID 6104 wrote to memory of 5824	6104	cmd.exe	109
PID 6104 wrote to memory of 912	6104	cmd.exe	110
PID 6104 wrote to memory of 1656	6104	cmd.exe	111
PID 6104 wrote to memory of 1908	6104	cmd.exe	112
PID 6104 wrote to memory of 5016	6104	cmd.exe	113
PID 6104 wrote to memory of 5760	6104	cmd.exe	114
PID 5760 wrote to memory of 5088	5760	cmd.exe	115
PID 6104 wrote to memory of 1684	6104	cmd.exe	116
PID 6104 wrote to memory of 1680	6104	cmd.exe	117
PID 6104 wrote to memory of 1100	6104	cmd.exe	118
PID 1100 wrote to memory of 5296	1100	cmd.exe	119
PID 6104 wrote to memory of 656	6104	cmd.exe	120
PID 6104 wrote to memory of 3120	6104	cmd.exe	121
PID 6104 wrote to memory of 5348	6104	cmd.exe	122
PID 5348 wrote to memory of 1444	5348	cmd.exe	123
PID 6104 wrote to memory of 2232	6104	cmd.exe	124
PID 6104 wrote to memory of 2028	6104	cmd.exe	125
PID 6104 wrote to memory of 2100	6104	cmd.exe	126
PID 6104 wrote to memory of 1520	6104	cmd.exe	127
PID 6104 wrote to memory of 5416	6104	cmd.exe	128
PID 6104 wrote to memory of 4448	6104	cmd.exe	129
PID 6104 wrote to memory of 2320	6104	cmd.exe	130
PID 6104 wrote to memory of 3752	6104	cmd.exe	131
PID 3752 wrote to memory of 5932	3752	cmd.exe	132
PID 6104 wrote to memory of 4588	6104	cmd.exe	133
PID 6104 wrote to memory of 3908	6104	cmd.exe	134
PID 6104 wrote to memory of 4344	6104	cmd.exe	135
PID 6104 wrote to memory of 1620	6104	cmd.exe	136
PID 1620 wrote to memory of 5500	1620	cmd.exe	137
PID 6104 wrote to memory of 4076	6104	cmd.exe	138
PID 6104 wrote to memory of 5232	6104	cmd.exe	139
PID 6104 wrote to memory of 5036	6104	cmd.exe	140
PID 5036 wrote to memory of 5112	5036	cmd.exe	141
PID 6104 wrote to memory of 4580	6104	cmd.exe	142
PID 6104 wrote to memory of 1616	6104	cmd.exe	143
PID 6104 wrote to memory of 3364	6104	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\Retrac Temp Spoofer(1).exe
"C:\Users\Admin\AppData\Local\Temp\Retrac Temp Spoofer(1).exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2192
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Windows\System32\retrac_cleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3344
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat" /f
    3⤵
    PID:3288
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat_EOS" /f
    3⤵
    PID:5144
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\EasyAntiCheat" /f
    3⤵
    PID:5300
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\EasyAntiCheat_EOS" /f
    3⤵
    PID:4792
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\WOW6432Node\BattlEye" /f
    3⤵
    PID:4252
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\BattlEye" /f
    3⤵
    PID:5448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic useraccount where name="Admin" get sid /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic useraccount where name="Admin" get sid /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4308
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:1760
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\bam\State\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:5856
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:3240
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\bam\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:5276
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\bam\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:2092
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bam\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:5636
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\dam\State\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:3696
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\dam\State\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:2284
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dam\State\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:4460
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\dam\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:2216
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\dam\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:5872
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dam\UserSettings\S-1-5-21-2397528088-2630719772-1129911217-1000" /f
    3⤵
    PID:836
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Control\CI\Aggregation" /f
    3⤵
    PID:1328
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Control\CI\Aggregation" /f
    3⤵
    PID:5216
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Control\CI\Aggregation" /f
    3⤵
    PID:2548
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules" /f
    3⤵
    - Modifies firewall policy service
    PID:5824
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules" /f
    3⤵
    PID:912
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules" /f
    3⤵
    PID:1656
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\discord-432980957394370572" /f
    3⤵
    PID:1908
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Classes\discord-432980957394370572" /f
    3⤵
    PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:5088
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\System\GameConfigStore" /f
    3⤵
    PID:1684
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\GameDVR" /f
    3⤵
    PID:1680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:5296
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Epic Games\Unreal Engine\Identifiers" /f
    3⤵
    PID:656
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Epic Games\Unreal Engine\Hardware Survey" /f
    3⤵
    PID:3120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:1444
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\NVDisplay.ContainerLocalSystem\LocalSystem\NVDisplay.ContainerLocalSystem\DisplayDriverRAS\GPUActivation" /f
    3⤵
    PID:2232
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\NVDisplay.ContainerLocalSystem\LocalSystem\NVDisplay.ContainerLocalSystem\DisplayDriverRAS\GPUActivation" /f
    3⤵
    PID:2028
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\NVDisplay.ContainerLocalSystem\LocalSystem\NVDisplay.ContainerLocalSystem\DisplayDriverRAS\GPUActivation" /f
    3⤵
    PID:2100
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet001\Services\VSS\Diag" /f
    3⤵
    PID:1520
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\ControlSet002\Services\VSS\Diag" /f
    3⤵
    PID:5416
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\VSS\Diag" /f
    3⤵
    PID:4448
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{DE7B24EA-73C8-4A09-985D-5BDADCFA9017}.check.800" /f
    3⤵
    PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:5932
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /f
    3⤵
    PID:4588
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /f
    3⤵
    PID:3908
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /f
    3⤵
    PID:4344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:5500
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count" /f
    3⤵
    PID:4076
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count" /f
    3⤵
    PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:5112
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\Software\Microsoft\TIP\AggregateResults" /f
    3⤵
    PID:4580
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f
    3⤵
    - Modifies registry class
    PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    PID:3364
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:4228
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /f
    3⤵
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    PID:2880
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:4396
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /f
    3⤵
    PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    PID:2500
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:2388
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths" /f
    3⤵
    PID:584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    PID:4000
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:3044
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery" /f
    3⤵
    PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKU" 2>nul
    3⤵
    PID:784
  - - C:\Windows\system32\reg.exe
      reg query "HKU"
      4⤵
      PID:3076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil el 2>nul
    3⤵
    PID:2716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil el
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "AMSI/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "AirSpaceChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Application"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "DirectShowFilterGraph"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "DirectShowPluginControl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Els_Hyphenation/Analytic"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "EndpointMapper"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "FirstUXPerf-Analytic"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "ForwardedEvents"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "General Logging"
    3⤵
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "HardwareEvents"
    3⤵
    PID:4868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "IHM_DebugChannel"
    3⤵
    PID:4624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS-GPIO/Analytic"
    3⤵
    PID:684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS-I2C/Analytic"
    3⤵
    PID:4992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-GPIO2/Debug"
    3⤵
    - Clears Windows event logs
    PID:2596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-GPIO2/Performance"
    3⤵
    PID:436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-I2C/Debug"
    3⤵
    PID:5412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-I2C/Performance"
    3⤵
    PID:2080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Internet Explorer"
    3⤵
    PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Key Management Service"
    3⤵
    PID:2064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_MediaFoundationDeviceMFT"
    3⤵
    PID:1028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_MediaFoundationDeviceProxy"
    3⤵
    PID:5480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_MediaFoundationFrameServer"
    3⤵
    PID:5340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MedaFoundationVideoProc"
    3⤵
    - Clears Windows event logs
    PID:5820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MedaFoundationVideoProcD3D"
    3⤵
    PID:5040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationAsyncWrapper"
    3⤵
    - Clears Windows event logs
    PID:4296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationContentProtection"
    3⤵
    PID:4996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationDS"
    3⤵
    PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationDeviceProxy"
    3⤵
    PID:760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationMP4"
    3⤵
    PID:796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationMediaEngine"
    3⤵
    - Clears Windows event logs
    PID:984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPerformance"
    3⤵
    PID:3608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPerformanceCore"
    3⤵
    PID:32
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPipeline"
    3⤵
    PID:232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPlatform"
    3⤵
    PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationSrcPrefetch"
    3⤵
    PID:5100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client-Streamingux/Debug"
    3⤵
    PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Admin"
    3⤵
    PID:5352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Debug"
    3⤵
    PID:5548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Operational"
    3⤵
    PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    PID:2824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-SharedPerformance/Analytic"
    3⤵
    PID:2812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Admin"
    3⤵
    PID:2536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Debug"
    3⤵
    PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Diagnostic"
    3⤵
    PID:4772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-IE/Diagnostic"
    3⤵
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    PID:4856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    PID:3316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-OneCore-Setup/Analytic"
    3⤵
    PID:1464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    PID:5164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    PID:488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"
    3⤵
    PID:4640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Admin/Debug"
    3⤵
    PID:4664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
    3⤵
    - Clears Windows event logs
    PID:3384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
    3⤵
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Debug"
    3⤵
    PID:4924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    PID:4648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    PID:4804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
    3⤵
    PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
    3⤵
    PID:3136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    PID:3328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AAD/Analytic"
    3⤵
    PID:3156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AAD/Operational"
    3⤵
    PID:1712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    PID:2844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ASN1/Operational"
    3⤵
    PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ATAPort/General"
    3⤵
    PID:4484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    PID:5004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    PID:4956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-All-User-Install-Agent/Admin"
    3⤵
    - Clears Windows event logs
    PID:4948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AllJoyn/Debug"
    3⤵
    PID:3632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AllJoyn/Operational"
    3⤵
    PID:4164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Admin"
    3⤵
    PID:4488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/ApplicationTracing"
    3⤵
    PID:4712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Diagnostic"
    3⤵
    PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Internal"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:4216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:3260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:3760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    PID:5816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Admin"
    3⤵
    PID:4472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Analytic"
    3⤵
    PID:5376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Debug"
    3⤵
    PID:1732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
    3⤵
    PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-State/Debug"
    3⤵
    PID:5868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-State/Diagnostic"
    3⤵
    PID:5224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Admin"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Debug"
    3⤵
    PID:5524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Operational"
    3⤵
    PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppSruProv"
    3⤵
    PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeployment/Diagnostic"
    3⤵
    PID:4252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeployment/Operational"
    3⤵
    PID:5448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Debug"
    3⤵
    - Clears Windows event logs
    PID:660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
    3⤵
    PID:3092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Operational"
    3⤵
    PID:3856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
    3⤵
    PID:1760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
    3⤵
    PID:5856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Operational"
    3⤵
    PID:3240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Analytic"
    3⤵
    PID:2092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Debug"
    3⤵
    PID:5636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    PID:3696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
    3⤵
    PID:2284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
    3⤵
    PID:4460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:2216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
    3⤵
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
    3⤵
    PID:1556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"
    3⤵
    PID:4376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
    3⤵
    PID:5544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
    3⤵
    - Clears Windows event logs
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Debug"
    3⤵
    PID:432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Operational"
    3⤵
    PID:3368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Performance"
    3⤵
    PID:1924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccess/Admin"
    3⤵
    PID:4036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccess/Operational"
    3⤵
    PID:4308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Admin"
    3⤵
    PID:5196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Operational"
    3⤵
    PID:5476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AsynchronousCausality/Causality"
    3⤵
    - Clears Windows event logs
    PID:1564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"
    3⤵
    - Clears Windows event logs
    PID:3644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/GlitchDetection"
    3⤵
    PID:1796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Informational"
    3⤵
    PID:1392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Operational"
    3⤵
    PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Performance"
    3⤵
    PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/PlaybackManager"
    3⤵
    PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audit/Analytic"
    3⤵
    PID:5288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:1040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
    3⤵
    PID:5908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
    3⤵
    PID:3392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
    3⤵
    PID:4776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
    3⤵
    PID:5652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AxInstallService/Log"
    3⤵
    - Clears Windows event logs
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHPORT/HCI"
    3⤵
    - Clears Windows event logs
    PID:2520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
    3⤵
    PID:4284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
    3⤵
    PID:4588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Performance"
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
    3⤵
    PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
    3⤵
    PID:5320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
    3⤵
    PID:5756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Backup"
    3⤵
    PID:3556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
    3⤵
    PID:6140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
    3⤵
    PID:5112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Battery/Diagnostic"
    3⤵
    PID:416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Biometrics/Analytic"
    3⤵
    - Clears Windows event logs
    PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Biometrics/Operational"
    3⤵
    PID:2960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
    3⤵
    PID:4192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
    3⤵
    PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
    3⤵
    PID:2240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Management"
    3⤵
    PID:324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Operational"
    3⤵
    PID:3304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/Tracing"
    3⤵
    PID:600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bits-Client/Analytic"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bits-Client/Operational"
    3⤵
    PID:5172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
    3⤵
    PID:3044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
    3⤵
    PID:5420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
    3⤵
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-Policy/Operational"
    3⤵
    PID:536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCache/Operational"
    3⤵
    PID:5128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
    3⤵
    PID:5584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
    3⤵
    PID:5408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
    3⤵
    PID:2632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"
    3⤵
    PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"
    3⤵
    PID:5776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
    3⤵
    PID:6024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CAPI2/Operational"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CDROM/Operational"
    3⤵
    PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/Analytic"
    3⤵
    PID:3728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ApartmentInitialize"
    3⤵
    PID:2720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ApartmentUninitialize"
    3⤵
    PID:3204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/Call"
    3⤵
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/CreateInstance"
    3⤵
    - Clears Windows event logs
    PID:4868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ExtensionCatalog"
    3⤵
    PID:4624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/FreeUnusedLibrary"
    3⤵
    PID:684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/RundownInstrumentation"
    3⤵
    PID:4992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/Activations"
    3⤵
    PID:2596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/MessageProcessing"
    3⤵
    PID:436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/Tracing"
    3⤵
    PID:5412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertPoleEng/Operational"
    3⤵
    PID:2080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
    3⤵
    PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
    3⤵
    PID:5060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
    3⤵
    PID:1028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Cleanmgr/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
    3⤵
    PID:5340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Debug"
    3⤵
    PID:5820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Operational"
    3⤵
    PID:5040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CmiSetup/Analytic"
    3⤵
    PID:4296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"
    3⤵
    PID:4996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"
    3⤵
    PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ComDlg32/Analytic"
    3⤵
    PID:760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ComDlg32/Debug"
    3⤵
    - Clears Windows event logs
    PID:796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Compat-Appraiser/Analytic"
    3⤵
    PID:984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Compat-Appraiser/Operational"
    3⤵
    PID:3608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-BindFlt/Debug"
    3⤵
    - Clears Windows event logs
    PID:32
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-BindFlt/Operational"
    3⤵
    PID:232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-Wcifs/Debug"
    3⤵
    PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-Wcifs/Operational"
    3⤵
    PID:5100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Diagnostic"
    3⤵
    PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Operational"
    3⤵
    PID:5352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Tracing"
    3⤵
    PID:5548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
    3⤵
    PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
    3⤵
    PID:2824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreWindow/Analytic"
    3⤵
    PID:2812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreWindow/Debug"
    3⤵
    PID:2536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
    3⤵
    PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
    3⤵
    PID:4772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crashdump/Operational"
    3⤵
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CredUI/Diagnostic"
    3⤵
    PID:4856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
    3⤵
    PID:3316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-CNG/Analytic"
    3⤵
    PID:1464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
    3⤵
    PID:5988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Debug"
    3⤵
    PID:5744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Operational"
    3⤵
    PID:4544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
    3⤵
    PID:2892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/Operational"
    3⤵
    PID:1276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"
    3⤵
    PID:2856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"
    3⤵
    PID:2700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"
    3⤵
    PID:3920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAL-Provider/Analytic"
    3⤵
    PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAL-Provider/Operational"
    3⤵
    PID:2336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAMM/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:2400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DCLocator/Debug"
    3⤵
    - Clears Windows event logs
    PID:3576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DDisplay/Analytic"
    3⤵
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DDisplay/Logging"
    3⤵
    PID:2452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DLNA-Namespace/Analytic"
    3⤵
    PID:4812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
    3⤵
    PID:2188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Admin"
    3⤵
    PID:4876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Analytic"
    3⤵
    PID:1312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Debug"
    3⤵
    PID:4960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Operational"
    3⤵
    PID:976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DUI/Diagnostic"
    3⤵
    PID:5784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DUSER/Diagnostic"
    3⤵
    PID:2980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXGI/Analytic"
    3⤵
    PID:4500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXGI/Logging"
    3⤵
    PID:4492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXP/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Data-Pdf/Debug"
    3⤵
    PID:5260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DataIntegrityScan/Admin"
    3⤵
    PID:3132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
    3⤵
    PID:3400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
    3⤵
    PID:1600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"
    3⤵
    PID:1544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"
    3⤵
    PID:1532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Diagnostic"
    3⤵
    PID:3680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Operational"
    3⤵
    PID:5976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Performance"
    3⤵
    PID:5780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Scrubbing"
    3⤵
    PID:2360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Defrag-Core/Debug"
    3⤵
    - Clears Windows event logs
    PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deplorch/Analytic"
    3⤵
    PID:5084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
    3⤵
    PID:3996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic"
    3⤵
    PID:2968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceAssociationService/Performance"
    3⤵
    PID:5904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceConfidence/Analytic"
    3⤵
    - Clears Windows event logs
    PID:3636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceGuard/Operational"
    3⤵
    PID:1132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceGuard/Verbose"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
    3⤵
    PID:3148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot"
    3⤵
    PID:3812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
    3⤵
    PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
    3⤵
    PID:5160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Admin"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Analytic"
    3⤵
    PID:1044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Debug"
    3⤵
    PID:4348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Operational"
    3⤵
    PID:4004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSync/Analytic"
    3⤵
    PID:1036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSync/Operational"
    3⤵
    PID:1788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
    3⤵
    PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUx/Informational"
    3⤵
    PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUx/Performance"
    3⤵
    PID:4432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Devices-Background/Operational"
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"
    3⤵
    PID:4012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"
    3⤵
    PID:380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"
    3⤵
    PID:5280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"
    3⤵
    PID:3532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiagCpl/Debug"
    3⤵
    PID:1716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
    3⤵
    PID:1992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
    3⤵
    PID:568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"
    3⤵
    - Clears Windows event logs
    PID:5632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"
    3⤵
    PID:2144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
    3⤵
    PID:1784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
    3⤵
    PID:2472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"
    3⤵
    PID:3440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"
    3⤵
    - Clears Windows event logs
    PID:3684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"
    3⤵
    PID:1748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"
    3⤵
    PID:3388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
    3⤵
    PID:3912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
    3⤵
    PID:1188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
    3⤵
    PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
    3⤵
    PID:5364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
    3⤵
    PID:644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
    3⤵
    PID:792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
    3⤵
    - Clears Windows event logs
    PID:5680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
    3⤵
    PID:4816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"
    3⤵
    PID:1700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"
    3⤵
    PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"
    3⤵
    PID:4808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
    3⤵
    PID:3664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
    3⤵
    PID:5380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"
    3⤵
    PID:3100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D10/Analytic"
    3⤵
    PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"
    3⤵
    PID:1396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/Analytic"
    3⤵
    PID:5236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/Logging"
    3⤵
    PID:4980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"
    3⤵
    - Clears Windows event logs
    PID:1828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/Analytic"
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/Logging"
    3⤵
    PID:1616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/PerfTiming"
    3⤵
    - Clears Windows event logs
    PID:4368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D9/Analytic"
    3⤵
    PID:2724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3DShaderCache/Default"
    3⤵
    PID:1720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectComposition/Diagnostic"
    3⤵
    PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectManipulation/Diagnostic"
    3⤵
    PID:3808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
    3⤵
    PID:1412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectSound/Debug"
    3⤵
    - Clears Windows event logs
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Disk/Operational"
    3⤵
    - Clears Windows event logs
    PID:2388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"
    3⤵
    - Clears Windows event logs
    PID:1244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
    3⤵
    PID:5292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
    3⤵
    PID:2296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/Analytic"
    3⤵
    PID:3748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
    3⤵
    PID:5200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
    3⤵
    PID:5156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Cli/Analytic"
    3⤵
    PID:5396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"
    3⤵
    PID:5752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"
    3⤵
    PID:3780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
    3⤵
    PID:3552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Documents/Performance"
    3⤵
    PID:4844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dot3MM/Diagnostic"
    3⤵
    PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
    3⤵
    PID:4916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-API/Diagnostic"
    3⤵
    PID:4928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Core/Diagnostic"
    3⤵
    PID:3596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
    3⤵
    PID:3828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
    3⤵
    PID:5968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-Admin"
    3⤵
    PID:6048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-Operational"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Contention"
    3⤵
    PID:2476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"
    3⤵
    PID:2560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Performance"
    3⤵
    PID:3600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Power"
    3⤵
    PID:5688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
    3⤵
    PID:5564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Application-Learning/Admin"
    3⤵
    - Clears Windows event logs
    PID:564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
    3⤵
    PID:3340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
    3⤵
    PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EFS/Debug"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ESE/IODiagnose"
    3⤵
    PID:4632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ESE/Operational"
    3⤵
    PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Analytic"
    3⤵
    PID:2940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Debug"
    3⤵
    PID:876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Operational"
    3⤵
    PID:2952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-RasChap/Operational"
    3⤵
    PID:3308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-RasTls/Operational"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-Sim/Operational"
    3⤵
    PID:3932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-Ttls/Operational"
    3⤵
    PID:2792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
    3⤵
    PID:1064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
    3⤵
    PID:236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
    3⤵
    PID:4532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorClass/Operational"
    3⤵
    PID:5256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
    3⤵
    - Clears Windows event logs
    PID:5432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventCollector/Debug"
    3⤵
    PID:4796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventCollector/Operational"
    3⤵
    PID:5360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
    3⤵
    PID:2204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog/Analytic"
    3⤵
    PID:3256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog/Debug"
    3⤵
    PID:4676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Analytic"
    3⤵
    PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Debug"
    3⤵
    - Clears Windows event logs
    PID:3064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Operational"
    3⤵
    PID:5880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
    3⤵
    PID:5812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
    3⤵
    PID:3184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FeatureConfiguration/Analytic"
    3⤵
    PID:2384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FeatureConfiguration/Operational"
    3⤵
    PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
    3⤵
    PID:3372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
    3⤵
    PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Debug"
    3⤵
    PID:2784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
    3⤵
    PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
    3⤵
    PID:5700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/Analytic"
    3⤵
    PID:4664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/Debug"
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/WHC"
    3⤵
    PID:3736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/Analytic"
    3⤵
    PID:3176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
    3⤵
    PID:5948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/Debug"
    3⤵
    PID:4648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
    3⤵
    PID:4804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Debug"
    3⤵
    PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Service/Analytic"
    3⤵
    PID:3036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Service/Debug"
    3⤵
    PID:4884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
    3⤵
    PID:4864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"
    3⤵
    PID:5952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
    3⤵
    PID:5068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Folder Redirection/Operational"
    3⤵
    PID:4840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Forwarding/Debug"
    3⤵
    PID:1284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Forwarding/Operational"
    3⤵
    PID:2396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
    3⤵
    PID:5272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GenericRoaming/Admin"
    3⤵
    PID:3632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GroupPolicy/Operational"
    3⤵
    PID:5888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HAL/Debug"
    3⤵
    PID:4488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenter/Debug"
    3⤵
    PID:4712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenter/Performance"
    3⤵
    PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"
    3⤵
    PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HelloForBusiness/Operational"
    3⤵
    PID:2328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Help/Operational"
    3⤵
    PID:3860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
    3⤵
    PID:3760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
    3⤵
    PID:5816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HotspotAuth/Analytic"
    3⤵
    PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HotspotAuth/Operational"
    3⤵
    PID:4472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HttpService/Log"
    3⤵
    - Clears Windows event logs
    PID:5376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HttpService/Trace"
    3⤵
    PID:1732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
    3⤵
    PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
    3⤵
    PID:5868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
    3⤵
    PID:5224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
    3⤵
    PID:5524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
    3⤵
    - Clears Windows event logs
    PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
    3⤵
    PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
    3⤵
    PID:4252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-KMCL-Child/Analytic"
    3⤵
    PID:5448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
    3⤵
    PID:660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-VID-Admin"
    3⤵
    PID:3092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-VID-Analytic"
    3⤵
    PID:3856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IE-SmartScreen"
    3⤵
    PID:1760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IKE/Operational"
    3⤵
    PID:5856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IKEDBG/Debug"
    3⤵
    PID:3240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-Broker/Analytic"
    3⤵
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CandidateUI/Analytic"
    3⤵
    PID:2092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
    3⤵
    PID:1036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
    3⤵
    PID:3696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPAPI/Analytic"
    3⤵
    PID:2284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPLMP/Analytic"
    3⤵
    PID:4460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPPRED/Analytic"
    3⤵
    PID:836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPSetting/Analytic"
    3⤵
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPTIP/Analytic"
    3⤵
    PID:1556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-KRAPI/Analytic"
    3⤵
    PID:4376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-KRTIP/Analytic"
    3⤵
    PID:5544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
    3⤵
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TCCORE/Analytic"
    3⤵
    PID:432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TCTIP/Analytic"
    3⤵
    PID:3368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TIP/Analytic"
    3⤵
    PID:1924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPNAT/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:3880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPxlatCfg/Debug"
    3⤵
    PID:5088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPxlatCfg/Operational"
    3⤵
    PID:2276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IdCtrls/Analytic"
    3⤵
    PID:3360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IdCtrls/Operational"
    3⤵
    PID:2348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
    3⤵
    PID:5296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
    3⤵
    PID:656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-InputSwitch/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:3120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
    3⤵
    PID:1792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"
    3⤵
    PID:3168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"
    3⤵
    PID:2780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"
    3⤵
    PID:2028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KdsSvc/Operational"
    3⤵
    PID:2100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos/Operational"
    3⤵
    PID:1520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
    3⤵
    PID:5416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-AppCompat/General"
    3⤵
    PID:4448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-AppCompat/Performance"
    3⤵
    PID:2320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
    3⤵
    PID:1112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
    3⤵
    PID:1780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"
    3⤵
    PID:4588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Boot/Operational"
    3⤵
    PID:5860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
    3⤵
    PID:5232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-CPU-Starvation/Operational"
    3⤵
    PID:3356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Cache/Operational"
    3⤵
    PID:5764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"
    3⤵
    - Clears Windows event logs
    PID:3116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Dump/Operational"
    3⤵
    PID:980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"
    3⤵
    - Clears Windows event logs
    PID:4228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
    3⤵
    PID:5840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-File/Analytic"
    3⤵
    PID:5424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-IO/Operational"
    3⤵
    PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
    3⤵
    PID:5336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
    3⤵
    PID:3504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
    3⤵
    PID:1628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Operational"
    3⤵
    PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"
    3⤵
    PID:752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PRM/Operational"
    3⤵
    PID:5132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
    3⤵
    PID:3076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
    3⤵
    PID:4248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
    3⤵
    PID:5316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"
    3⤵
    PID:3896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Management"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
    3⤵
    PID:2480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
    3⤵
    - Clears Windows event logs
    PID:1056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"
    3⤵
    PID:4652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
    3⤵
    PID:2656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
    3⤵
    PID:4932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
    3⤵
    PID:2528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"
    3⤵
    PID:5852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
    3⤵
    PID:1868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"
    3⤵
    PID:5788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Registry/Performance"
    3⤵
    PID:3476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
    3⤵
    PID:2016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
    3⤵
    PID:684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
    3⤵
    PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
    3⤵
    PID:3704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
    3⤵
    PID:5656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"
    3⤵
    PID:4736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"
    3⤵
    PID:420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"
    3⤵
    PID:2064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"
    3⤵
    PID:3864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"
    3⤵
    PID:464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-XDV/Analytic"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Admin"
    3⤵
    - Clears Windows event logs
    PID:5452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Operational"
    3⤵
    PID:5612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Performance"
    3⤵
    - Clears Windows event logs
    PID:2940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Known Folders API Service"
    3⤵
    PID:5472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-L2NA/Diagnostic"
    3⤵
    PID:4852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LDAP-Client/Debug"
    3⤵
    PID:4692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Diagnostic"
    3⤵
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Operational"
    3⤵
    PID:1728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Performance"
    3⤵
    PID:2456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
    3⤵
    PID:240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"
    3⤵
    PID:4608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"
    3⤵
    PID:5508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"
    3⤵
    PID:5504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LimitsManagement/Diagnostic"
    3⤵
    PID:4796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
    3⤵
    PID:2204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LiveId/Analytic"
    3⤵
    PID:3256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LiveId/Operational"
    3⤵
    PID:4676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
    3⤵
    PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
    3⤵
    PID:3064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"
    3⤵
    PID:5880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"
    3⤵
    PID:5812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
    3⤵
    PID:3184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Admin"
    3⤵
    PID:4856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Analytic"
    3⤵
    PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Debug"
    3⤵
    PID:488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Operational"
    3⤵
    PID:1468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/DMC"
    3⤵
    PID:2892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/DMR"
    3⤵
    PID:1276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/MDE"
    3⤵
    PID:2856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
    3⤵
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
    3⤵
    PID:2700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
    3⤵
    PID:5696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
    3⤵
    PID:2552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
    3⤵
    PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
    3⤵
    PID:4616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
    3⤵
    - Clears Windows event logs
    PID:2400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Minstore/Analytic"
    3⤵
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Minstore/Debug"
    3⤵
    PID:2452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
    3⤵
    PID:4812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
    3⤵
    PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
    3⤵
    PID:4876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MobilityCenter/Performance"
    3⤵
    PID:1312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
    3⤵
    PID:4960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
    3⤵
    - Clears Windows event logs
    PID:976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
    3⤵
    PID:5784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics"
    3⤵
    - Clears Windows event logs
    PID:2084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
    3⤵
    PID:4088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MosHost/Operational"
    3⤵
    PID:3544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MosHost/Performance"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mprddm/Operational"
    3⤵
    PID:4216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NCSI/Analytic"
    3⤵
    PID:3260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NCSI/Operational"
    3⤵
    PID:5384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
    3⤵
    PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
    3⤵
    PID:5624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS/Diagnostic"
    3⤵
    PID:1540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS/Operational"
    3⤵
    PID:5372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NTLM/Operational"
    3⤵
    PID:3004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"
    3⤵
    PID:5020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Narrator/Diagnostic"
    3⤵
    PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ncasvc/Operational"
    3⤵
    PID:1000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
    3⤵
    PID:5300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NcdAutoSetup/Operational"
    3⤵
    PID:6100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NdisImPlatform/Operational"
    3⤵
    PID:2956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ndu/Diagnostic"
    3⤵
    PID:3396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetShell/Performance"
    3⤵
    PID:648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-Connection-Broker"
    3⤵
    PID:2572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-DataUsage/Analytic"
    3⤵
    PID:1228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-ExecutionContext/Operational"
    3⤵
    PID:5492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-Setup/Diagnostic"
    3⤵
    PID:5496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
    3⤵
    PID:828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkBridge/Diagnostic"
    3⤵
    PID:5600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkLocationWizard/Operational"
    3⤵
    PID:5984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"
    3⤵
    PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProfile/Operational"
    3⤵
    PID:4356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvider/Operational"
    3⤵
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvisioning/Analytic"
    3⤵
    PID:4056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvisioning/Operational"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkSecurity/Debug"
    3⤵
    PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
    3⤵
    PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
    3⤵
    - System Time Discovery
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NlaSvc/Operational"
    3⤵
    PID:576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/Operational"
    3⤵
    PID:380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/Performance"
    3⤵
    - Clears Windows event logs
    PID:5280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/WHC"
    3⤵
    - Clears Windows event logs
    PID:1912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLE/Clipboard-Performance"
    3⤵
    PID:5832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLEACC/Debug"
    3⤵
    - Clears Windows event logs
    PID:5220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"
    3⤵
    PID:2344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
    3⤵
    PID:5632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
    3⤵
    PID:2144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
    3⤵
    PID:1564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
    3⤵
    PID:3644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
    3⤵
    PID:1796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"
    3⤵
    PID:4116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Debug"
    3⤵
    PID:388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Operational"
    3⤵
    PID:1508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"
    3⤵
    PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneBackup/Debug"
    3⤵
    PID:2232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneX/Diagnostic"
    3⤵
    PID:1072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneX/Operational"
    3⤵
    PID:4324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OobeLdr/Analytic"
    3⤵
    PID:2484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OtpCredentialProvider/Operational"
    3⤵
    PID:4784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PCI/Diagnostic"
    3⤵
    PID:5680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ParentalControls/Operational"
    3⤵
    PID:5652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Analytic"
    3⤵
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Diagnostic"
    3⤵
    PID:2520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"
    3⤵
    PID:4284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PerceptionRuntime/Operational"
    3⤵
    PID:3488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
    3⤵
    - Clears Windows event logs
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
    3⤵
    PID:5928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
    3⤵
    PID:3100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
    3⤵
    PID:5876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
    3⤵
    PID:3556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
    3⤵
    PID:5232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
    3⤵
    PID:5764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
    3⤵
    PID:3116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
    3⤵
    PID:980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
    3⤵
    PID:4228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
    3⤵
    PID:5840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PhotoAcq/Analytic"
    3⤵
    PID:5424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PlayToManager/Analytic"
    3⤵
    PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Policy/Analytic"
    3⤵
    PID:5336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Policy/Operational"
    3⤵
    PID:3504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
    3⤵
    PID:1628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
    3⤵
    PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Power-Meter-Polling/Diagnostic"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"
    3⤵
    - Power Settings
    PID:752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"
    3⤵
    PID:5132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
    3⤵
    PID:3076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
    3⤵
    PID:4248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
    3⤵
    PID:5316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
    3⤵
    PID:3896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Admin"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Analytic"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Debug"
    3⤵
    PID:3552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    PID:4844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"
    3⤵
    PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintBRM/Admin"
    3⤵
    - Clears Windows event logs
    PID:4916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService-USBMon/Debug"
    3⤵
    - Clears Windows event logs
    PID:2448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Admin"
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Debug"
    3⤵
    PID:3264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Operational"
    3⤵
    PID:3204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Privacy-Auditing/Operational"
    3⤵
    PID:6108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
    3⤵
    PID:6112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:3180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
    3⤵
    - Clears Windows event logs
    PID:2992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
    3⤵
    PID:4992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
    3⤵
    PID:2596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
    3⤵
    PID:5616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
    3⤵
    PID:2896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Diagnostic"
    3⤵
    PID:2080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Informational"
    3⤵
    PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Performance"
    3⤵
    PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Developer/Debug"
    3⤵
    PID:2808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-InProc/Debug"
    3⤵
    PID:1292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Admin"
    3⤵
    PID:1192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Debug"
    3⤵
    PID:4660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Operational"
    3⤵
    - Clears Windows event logs
    PID:3460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
    3⤵
    PID:2952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"
    3⤵
    PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"
    3⤵
    PID:764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC/Debug"
    3⤵
    PID:3312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC/EEInfo"
    3⤵
    PID:124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RRAS/Debug"
    3⤵
    PID:244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RRAS/Operational"
    3⤵
    PID:5484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RadioManager/Analytic"
    3⤵
    PID:4532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
    3⤵
    PID:5536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RasAgileVpn/Debug"
    3⤵
    PID:5432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RasAgileVpn/Operational"
    3⤵
    PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReFS/Operational"
    3⤵
    PID:5352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"
    3⤵
    PID:5548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoost/Operational"
    3⤵
    PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
    3⤵
    PID:2824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"
    3⤵
    PID:2812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Regsvr32/Operational"
    3⤵
    PID:2888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
    3⤵
    PID:1492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
    3⤵
    PID:1956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"
    3⤵
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"
    3⤵
    PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"
    3⤵
    PID:4612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
    3⤵
    PID:5972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
    3⤵
    PID:888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
    3⤵
    PID:2648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
    3⤵
    - Clears Windows event logs
    PID:1516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
    3⤵
    PID:2508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
    3⤵
    PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
    3⤵
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
    3⤵
    PID:4924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ResourcePublication/Tracing"
    3⤵
    PID:4648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RestartManager/Operational"
    3⤵
    PID:2904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RetailDemo/Admin"
    3⤵
    PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RetailDemo/Operational"
    3⤵
    PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Graphics/Analytic"
    3⤵
    PID:2040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
    3⤵
    PID:6052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Networking/Tracing"
    3⤵
    PID:4988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
    3⤵
    PID:5952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
    3⤵
    PID:4184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
    3⤵
    PID:5072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
    3⤵
    PID:1284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
    3⤵
    PID:5772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
    3⤵
    PID:4496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime/CreateInstance"
    3⤵
    PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime/Error"
    3⤵
    - Clears Windows event logs
    PID:5888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/Analytic"
    3⤵
    PID:4488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
    3⤵
    PID:4712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
    3⤵
    PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/Operational"
    3⤵
    PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBDirect/Admin"
    3⤵
    PID:2328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBDirect/Debug"
    3⤵
    PID:3860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBDirect/Netmon"
    3⤵
    PID:3760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Analytic"
    3⤵
    PID:5816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Audit"
    3⤵
    PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Connectivity"
    3⤵
    PID:5664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Diagnostic"
    3⤵
    PID:4472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Operational"
    3⤵
    PID:1732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Performance"
    3⤵
    PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Security"
    3⤵
    PID:5868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBWitnessClient/Admin"
    3⤵
    PID:5224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBWitnessClient/Informational"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
    3⤵
    PID:4828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
    3⤵
    PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Schannel-Events/Perf"
    3⤵
    PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sdbus/Analytic"
    3⤵
    PID:4252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sdbus/Debug"
    3⤵
    PID:5448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sdstor/Analytic"
    3⤵
    - Clears Windows event logs
    PID:660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Search-Core/Diagnostic"
    3⤵
    PID:3692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
    3⤵
    PID:5496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SearchUI/Diagnostic"
    3⤵
    PID:828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SearchUI/Operational"
    3⤵
    PID:5600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecureAssessment/Operational"
    3⤵
    PID:5984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
    3⤵
    PID:4356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
    3⤵
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
    3⤵
    PID:4056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-IdentityStore/Performance"
    3⤵
    PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
    3⤵
    PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Mitigations/KernelMode"
    3⤵
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Mitigations/UserMode"
    3⤵
    PID:4464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Netlogon/Operational"
    3⤵
    PID:576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
    3⤵
    PID:380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
    3⤵
    PID:5280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX/Analytic"
    3⤵
    PID:1912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP/Perf"
    3⤵
    PID:4308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
    3⤵
    PID:5220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Vault/Performance"
    3⤵
    - Clears Windows event logs
    PID:1680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
    3⤵
    PID:1684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
    3⤵
    PID:1820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
    3⤵
    PID:5204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SendTo/Diagnostic"
    3⤵
    PID:3040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sens/Debug"
    3⤵
    PID:5676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sensors/Debug"
    3⤵
    PID:4832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sensors/Performance"
    3⤵
    - Clears Windows event logs
    PID:2472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
    3⤵
    PID:3440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
    3⤵
    PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

retrac_cleaner.bat

Path C:\Windows\System32\retrac_cleaner.bat
Size 11KB
SHA256 40883d404da4607bc6caf286bc7529d563d10e5310f4cc078ee6ebfb47fa939c
MD5 9f61eb426f5d6524627c98ce252ea3b3
SHA1 3ad423e0327ec518527d70e0ef3d4161edb8cadc
SHA512 15ba594a56539f0d25028d389ebdbf4db94ab49e7fbdb11ff3a297cf382634c76fd4780e4ff48c894e87886976cb6959033703d40d3b53889d4488ef6ab6087a
SSDEEP 192:atyG0SNYATJejOcOjOuOtOuUlO+OlOsODOsrbk8FFFcFobaJO7OBJiJO2OH4bJO4:syG0SNYAyTMded0Vuzczrbk8FFFcFWa0
TLSH
T13A320A223F524D555AE075C2E9AF88052BEE624B2D433FC0B6C33954BDA17582376BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2292-14-0x00000156DB150000-0x00000156DB15C000-memory.dmp

Download

memory/2292-13-0x00000156DAC50000-0x00000156DAD26000-memory.dmp

Download

memory/2292-18-0x00000156DB150000-0x00000156DB15C000-memory.dmp

Download

memory/2292-17-0x00000156DAC50000-0x00000156DAD26000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads