0cfa0ac908cb962bd283fdf4fb008e95d54394e5ff0d206c35e1bf9cdd6ad0a2

Analysis

max time kernel
118s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACK/HELPERS/CleanSystem/JurnalClear.bat
Size 9KB
Sample260706-ts5npadt3k
SHA256 0cfa0ac908cb962bd283fdf4fb008e95d54394e5ff0d206c35e1bf9cdd6ad0a2
MD5 94451f678eb3872903c7984feb1c8ab3
SHA1 74f2037b3ed35cfcca1a73f2145b0de522b0fd2b
SHA512 4a53708bee5e41d73e1aa7264b690cd9544cde6a952284e743a0670c547c1290431f5cb42dcf62aeee26390fde4b7a5db0d46b7086ebd50dbeb90280732013d9
SSDEEP 96:gDf2GF6s+jRa1xwOw8sSr0T81Z1W1y1z1+dbJK4irfkJe0xH1Tcxv7xZeZancZ0T:Cf2s6sHbW8keMHucACvjjFoH
TLSH
T1561222805CDD851292D1F7623B6B8921C3BBB685AD189B9B48CC0A20591EECDC17E1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
4848	wevtutil.exe
1864	wevtutil.exe
2308	wevtutil.exe
3876	Process not Found
4348	wevtutil.exe
932	wevtutil.exe
5004	wevtutil.exe
656	wevtutil.exe
3060	wevtutil.exe
224	wevtutil.exe
1468	Process not Found
4028	Process not Found
4188	wevtutil.exe
5060	wevtutil.exe
5108	wevtutil.exe
2920	wevtutil.exe
4704	wevtutil.exe
788	wevtutil.exe
3712	wevtutil.exe
644	wevtutil.exe
3328	wevtutil.exe
4484	wevtutil.exe
4392	wevtutil.exe
204	wevtutil.exe
4700	wevtutil.exe
4160	wevtutil.exe
4664	wevtutil.exe
1632	wevtutil.exe
3292	wevtutil.exe
4332	wevtutil.exe
5072	wevtutil.exe
3740	wevtutil.exe
384	wevtutil.exe
1052	wevtutil.exe
3212	wevtutil.exe
3732	wevtutil.exe
3100	wevtutil.exe
1668	wevtutil.exe
1624	wevtutil.exe
4264	wevtutil.exe
4980	wevtutil.exe
3440	wevtutil.exe
116	wevtutil.exe
2688	Process not Found
4744	wevtutil.exe
1176	wevtutil.exe
4192	wevtutil.exe
1404	wevtutil.exe
5072	wevtutil.exe
4512	wevtutil.exe
3496	Process not Found
4680	wevtutil.exe
3636	wevtutil.exe
4664	wevtutil.exe
4264	wevtutil.exe
4808	wevtutil.exe
4372	wevtutil.exe
1624	wevtutil.exe
3536	wevtutil.exe
3444	wevtutil.exe
3432	wevtutil.exe
3808	wevtutil.exe
3664	wevtutil.exe
4984	wevtutil.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1176	wevtutil.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4440	wevtutil.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4816	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4692	wevtutil.exe
Token: SeBackupPrivilege	4692	wevtutil.exe
Token: SeSecurityPrivilege	5068	wevtutil.exe
Token: SeBackupPrivilege	5068	wevtutil.exe
Token: SeSecurityPrivilege	1476	wevtutil.exe
Token: SeBackupPrivilege	1476	wevtutil.exe
Token: SeSecurityPrivilege	2808	wevtutil.exe
Token: SeBackupPrivilege	2808	wevtutil.exe
Token: SeSecurityPrivilege	3336	wevtutil.exe
Token: SeBackupPrivilege	3336	wevtutil.exe
Token: SeSecurityPrivilege	3032	wevtutil.exe
Token: SeBackupPrivilege	3032	wevtutil.exe
Token: SeSecurityPrivilege	3536	wevtutil.exe
Token: SeBackupPrivilege	3536	wevtutil.exe
Token: SeSecurityPrivilege	1128	wevtutil.exe
Token: SeBackupPrivilege	1128	wevtutil.exe
Token: SeSecurityPrivilege	4956	wevtutil.exe
Token: SeBackupPrivilege	4956	wevtutil.exe
Token: SeSecurityPrivilege	1584	wevtutil.exe
Token: SeBackupPrivilege	1584	wevtutil.exe
Token: SeSecurityPrivilege	4188	wevtutil.exe
Token: SeBackupPrivilege	4188	wevtutil.exe
Token: SeSecurityPrivilege	4264	wevtutil.exe
Token: SeBackupPrivilege	4264	wevtutil.exe
Token: SeSecurityPrivilege	3672	wevtutil.exe
Token: SeBackupPrivilege	3672	wevtutil.exe
Token: SeSecurityPrivilege	2556	wevtutil.exe
Token: SeBackupPrivilege	2556	wevtutil.exe
Token: SeSecurityPrivilege	4548	wevtutil.exe
Token: SeBackupPrivilege	4548	wevtutil.exe
Token: SeSecurityPrivilege	5060	wevtutil.exe
Token: SeBackupPrivilege	5060	wevtutil.exe
Token: SeSecurityPrivilege	1208	wevtutil.exe
Token: SeBackupPrivilege	1208	wevtutil.exe
Token: SeSecurityPrivilege	772	wevtutil.exe
Token: SeBackupPrivilege	772	wevtutil.exe
Token: SeSecurityPrivilege	3104	wevtutil.exe
Token: SeBackupPrivilege	3104	wevtutil.exe
Token: SeSecurityPrivilege	980	wevtutil.exe
Token: SeBackupPrivilege	980	wevtutil.exe
Token: SeSecurityPrivilege	2548	wevtutil.exe
Token: SeBackupPrivilege	2548	wevtutil.exe
Token: SeSecurityPrivilege	2300	wevtutil.exe
Token: SeBackupPrivilege	2300	wevtutil.exe
Token: SeSecurityPrivilege	4492	wevtutil.exe
Token: SeBackupPrivilege	4492	wevtutil.exe
Token: SeSecurityPrivilege	3740	wevtutil.exe
Token: SeBackupPrivilege	3740	wevtutil.exe
Token: SeSecurityPrivilege	2536	wevtutil.exe
Token: SeBackupPrivilege	2536	wevtutil.exe
Token: SeSecurityPrivilege	3212	wevtutil.exe
Token: SeBackupPrivilege	3212	wevtutil.exe
Token: SeSecurityPrivilege	3876	wevtutil.exe
Token: SeBackupPrivilege	3876	wevtutil.exe
Token: SeSecurityPrivilege	2720	wevtutil.exe
Token: SeBackupPrivilege	2720	wevtutil.exe
Token: SeSecurityPrivilege	260	wevtutil.exe
Token: SeBackupPrivilege	260	wevtutil.exe
Token: SeSecurityPrivilege	116	wevtutil.exe
Token: SeBackupPrivilege	116	wevtutil.exe
Token: SeSecurityPrivilege	4444	wevtutil.exe
Token: SeBackupPrivilege	4444	wevtutil.exe
Token: SeSecurityPrivilege	4380	wevtutil.exe
Token: SeBackupPrivilege	4380	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4816	3556	cmd.exe	85
PID 3556 wrote to memory of 2248	3556	cmd.exe	86
PID 3556 wrote to memory of 2012	3556	cmd.exe	88
PID 2012 wrote to memory of 644	2012	cmd.exe	89
PID 3556 wrote to memory of 2188	3556	cmd.exe	90
PID 2188 wrote to memory of 4692	2188	cmd.exe	91
PID 3556 wrote to memory of 5068	3556	cmd.exe	92
PID 3556 wrote to memory of 1476	3556	cmd.exe	93
PID 3556 wrote to memory of 2808	3556	cmd.exe	94
PID 3556 wrote to memory of 3336	3556	cmd.exe	95
PID 3556 wrote to memory of 3032	3556	cmd.exe	97
PID 3556 wrote to memory of 3536	3556	cmd.exe	98
PID 3556 wrote to memory of 1128	3556	cmd.exe	99
PID 3556 wrote to memory of 4956	3556	cmd.exe	100
PID 3556 wrote to memory of 1584	3556	cmd.exe	101
PID 3556 wrote to memory of 4188	3556	cmd.exe	103
PID 3556 wrote to memory of 4264	3556	cmd.exe	104
PID 3556 wrote to memory of 3672	3556	cmd.exe	105
PID 3556 wrote to memory of 2556	3556	cmd.exe	106
PID 3556 wrote to memory of 4548	3556	cmd.exe	107
PID 3556 wrote to memory of 5060	3556	cmd.exe	108
PID 3556 wrote to memory of 1208	3556	cmd.exe	109
PID 3556 wrote to memory of 772	3556	cmd.exe	110
PID 3556 wrote to memory of 3104	3556	cmd.exe	111
PID 3556 wrote to memory of 980	3556	cmd.exe	112
PID 3556 wrote to memory of 2548	3556	cmd.exe	113
PID 3556 wrote to memory of 2300	3556	cmd.exe	114
PID 3556 wrote to memory of 4492	3556	cmd.exe	115
PID 3556 wrote to memory of 3740	3556	cmd.exe	116
PID 3556 wrote to memory of 2536	3556	cmd.exe	117
PID 3556 wrote to memory of 3212	3556	cmd.exe	118
PID 3556 wrote to memory of 3876	3556	cmd.exe	119
PID 3556 wrote to memory of 2720	3556	cmd.exe	120
PID 3556 wrote to memory of 260	3556	cmd.exe	121
PID 3556 wrote to memory of 116	3556	cmd.exe	122
PID 3556 wrote to memory of 4444	3556	cmd.exe	123
PID 3556 wrote to memory of 4380	3556	cmd.exe	124
PID 3556 wrote to memory of 1864	3556	cmd.exe	125
PID 3556 wrote to memory of 4724	3556	cmd.exe	126
PID 3556 wrote to memory of 3484	3556	cmd.exe	127
PID 3556 wrote to memory of 2596	3556	cmd.exe	128
PID 3556 wrote to memory of 1764	3556	cmd.exe	129
PID 3556 wrote to memory of 4544	3556	cmd.exe	130
PID 3556 wrote to memory of 4912	3556	cmd.exe	131
PID 3556 wrote to memory of 4336	3556	cmd.exe	132
PID 3556 wrote to memory of 4476	3556	cmd.exe	133
PID 3556 wrote to memory of 1392	3556	cmd.exe	134
PID 3556 wrote to memory of 4524	3556	cmd.exe	135
PID 3556 wrote to memory of 2920	3556	cmd.exe	136
PID 3556 wrote to memory of 828	3556	cmd.exe	137
PID 3556 wrote to memory of 2792	3556	cmd.exe	138
PID 3556 wrote to memory of 944	3556	cmd.exe	139
PID 3556 wrote to memory of 1100	3556	cmd.exe	140
PID 3556 wrote to memory of 5012	3556	cmd.exe	141
PID 3556 wrote to memory of 5096	3556	cmd.exe	142
PID 3556 wrote to memory of 2336	3556	cmd.exe	143
PID 3556 wrote to memory of 656	3556	cmd.exe	144
PID 3556 wrote to memory of 5088	3556	cmd.exe	145
PID 3556 wrote to memory of 3892	3556	cmd.exe	146
PID 3556 wrote to memory of 900	3556	cmd.exe	147
PID 3556 wrote to memory of 4252	3556	cmd.exe	148
PID 3556 wrote to memory of 4080	3556	cmd.exe	149
PID 3556 wrote to memory of 1520	3556	cmd.exe	150
PID 3556 wrote to memory of 3388	3556	cmd.exe	151

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\CleanSystem\JurnalClear.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\system32\ipconfig.exe
  ipconfig / releaseipconfig / renewipconfig / flushdns
  2⤵
  - Gathers network information
  PID:4816
- C:\Windows\system32\chcp.com
  CHCP 866
  2⤵
  PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\bcdedit.exe
    bcdedit
    3⤵
    PID:644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wevtutil.exe el
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "AMSI/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "AirSpaceChannel"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Application"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "DirectShowFilterGraph"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "DirectShowPluginControl"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Els_Hyphenation/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "EndpointMapper"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "FirstUXPerf-Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "ForwardedEvents"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "General Logging"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "HardwareEvents"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "IHM_DebugChannel"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Internet Explorer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Key Management Service"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationFrameServer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MedaFoundationVideoProc"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MedaFoundationVideoProcD3D"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationAsyncWrapper"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationContentProtection"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationDS"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationDeviceProxy"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationMP4"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationMediaEngine"
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPerformance"
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPerformanceCore"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPipeline"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPlatform"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationSrcPrefetch"
  2⤵
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Admin"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Debug"
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Operational"
  2⤵
  PID:1392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"
  2⤵
  PID:828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"
  2⤵
  PID:2792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-IE/Diagnostic"
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
  2⤵
  PID:5012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"
  2⤵
  PID:2336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
  2⤵
  PID:656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
  2⤵
  PID:5088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"
  2⤵
  PID:3892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
  2⤵
  PID:4080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"
  2⤵
  PID:4936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
  2⤵
  PID:2780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AAD/Analytic"
  2⤵
  PID:4760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AAD/Operational"
  2⤵
  PID:4576
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
  2⤵
  PID:4396
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ASN1/Operational"
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
  2⤵
  - Clears Windows event logs
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"
  2⤵
  PID:2696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AllJoyn/Debug"
  2⤵
  PID:1480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AllJoyn/Operational"
  2⤵
  - Clears Windows event logs
  PID:1668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Admin"
  2⤵
  PID:1564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"
  2⤵
  PID:760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Internal"
  2⤵
  PID:960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
  2⤵
  PID:3644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
  2⤵
  PID:4816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
  2⤵
  PID:2248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
  2⤵
  PID:1812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"
  2⤵
  - Clears Windows event logs
  PID:644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"
  2⤵
  PID:4988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"
  2⤵
  PID:2084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
  2⤵
  PID:3808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"
  2⤵
  PID:3048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"
  2⤵
  PID:1308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"
  2⤵
  PID:2616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"
  2⤵
  PID:2180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppSruProv"
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"
  2⤵
  PID:1212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"
  2⤵
  PID:2848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"
  2⤵
  - Clears Windows event logs
  PID:4372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"
  2⤵
  PID:1448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
  2⤵
  PID:4264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"
  2⤵
  PID:3672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
  2⤵
  PID:2556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
  2⤵
  PID:3532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
  2⤵
  - Clears Windows event logs
  PID:4744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
  2⤵
  PID:1572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
  2⤵
  PID:4980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
  2⤵
  PID:4512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Debug"
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Operational"
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Performance"
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Admin"
  2⤵
  PID:260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Operational"
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Admin"
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Operational"
  2⤵
  PID:4380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AsynchronousCausality/Causality"
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/GlitchDetection"
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Informational"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/PlaybackManager"
  2⤵
  PID:2244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
  2⤵
  PID:3060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
  2⤵
  PID:4048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
  2⤵
  PID:4932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/HCI"
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
  2⤵
  PID:3836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:1176
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Performance"
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
  2⤵
  PID:4848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
  2⤵
  PID:4760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
  2⤵
  PID:2540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Backup"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
  2⤵
  PID:716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Battery/Diagnostic"
  2⤵
  PID:2868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Biometrics/Analytic"
  2⤵
  PID:2348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
  2⤵
  PID:4768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
  2⤵
  PID:312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Management"
  2⤵
  PID:3324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Operational"
  2⤵
  PID:1064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/Tracing"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
  2⤵
  PID:5108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-Policy/Operational"
  2⤵
  PID:3288
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
  2⤵
  PID:364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
  2⤵
  PID:864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
  2⤵
  PID:3900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
  2⤵
  PID:2564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
  2⤵
  PID:4292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ApartmentInitialize"
  2⤵
  PID:1020
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ApartmentUninitialize"
  2⤵
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/Call"
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/CreateInstance"
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ExtensionCatalog"
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/FreeUnusedLibrary"
  2⤵
  PID:1188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/RundownInstrumentation"
  2⤵
  - Clears Windows event logs
  PID:1624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/Activations"
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/MessageProcessing"
  2⤵
  PID:4516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
  2⤵
  PID:652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
  2⤵
  PID:3796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Cleanmgr/Diagnostic"
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
  2⤵
  PID:2308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Debug"
  2⤵
  PID:2536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Operational"
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Analytic"
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Operational"
  2⤵
  PID:4380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Debug"
  2⤵
  - Clears Windows event logs
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Operational"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Debug"
  2⤵
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Operational"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Debug"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Operational"
  2⤵
  PID:2544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Diagnostic"
  2⤵
  PID:2636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Operational"
  2⤵
  PID:2816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Tracing"
  2⤵
  PID:2244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
  2⤵
  PID:3060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreWindow/Analytic"
  2⤵
  PID:4048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreWindow/Debug"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
  2⤵
  PID:3928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crashdump/Operational"
  2⤵
  PID:1884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-CNG/Analytic"
  2⤵
  PID:656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Debug"
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Operational"
  2⤵
  PID:4848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
  2⤵
  PID:4760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/Operational"
  2⤵
  PID:2540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
  2⤵
  PID:716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
  2⤵
  PID:2868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Analytic"
  2⤵
  PID:2348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Operational"
  2⤵
  PID:4768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAMM/Diagnostic"
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
  2⤵
  PID:312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DDisplay/Analytic"
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DDisplay/Logging"
  2⤵
  PID:3324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DLNA-Namespace/Analytic"
  2⤵
  PID:1064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Admin"
  2⤵
  - Clears Windows event logs
  PID:5108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Analytic"
  2⤵
  - Clears Windows event logs
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Debug"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Operational"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
  2⤵
  PID:3288
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
  2⤵
  PID:364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
  2⤵
  PID:864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Data-Pdf/Debug"
  2⤵
  PID:3900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/Admin"
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
  2⤵
  PID:2564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Diagnostic"
  2⤵
  PID:4292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Operational"
  2⤵
  PID:1020
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Performance"
  2⤵
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Scrubbing"
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Defrag-Core/Debug"
  2⤵
  - Clears Windows event logs
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
  2⤵
  PID:1188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:1624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceAssociationService/Performance"
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceConfidence/Analytic"
  2⤵
  PID:4516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Operational"
  2⤵
  PID:652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Verbose"
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
  2⤵
  PID:3796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Admin"
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Analytic"
  2⤵
  PID:2308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Debug"
  2⤵
  PID:2536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Operational"
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
  2⤵
  PID:1152
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
  2⤵
  PID:1780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Devices-Background/Operational"
  2⤵
  PID:4272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
  2⤵
  PID:332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
  2⤵
  PID:3632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
  2⤵
  PID:1392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
  2⤵
  - Clears Windows event logs
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
  2⤵
  PID:828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
  2⤵
  PID:2792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
  2⤵
  PID:4028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
  2⤵
  PID:3960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
  2⤵
  PID:4632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
  2⤵
  PID:5032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
  2⤵
  PID:2336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
  2⤵
  PID:3836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
  2⤵
  PID:1652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
  2⤵
  PID:4396
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
  2⤵
  PID:388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"
  2⤵
  PID:3124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
  2⤵
  PID:552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
  2⤵
  PID:1480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
  2⤵
  PID:1668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
  2⤵
  PID:1564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
  2⤵
  PID:632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
  2⤵
  PID:1076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
  2⤵
  PID:860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4680
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/Logging"
  2⤵
  PID:4384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/PerfTiming"
  2⤵
  PID:1372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D9/Analytic"
  2⤵
  PID:4816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3DShaderCache/Default"
  2⤵
  PID:4004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectComposition/Diagnostic"
  2⤵
  PID:1620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectManipulation/Diagnostic"
  2⤵
  PID:456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
  2⤵
  PID:4988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
  2⤵
  PID:3048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
  2⤵
  PID:5084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
  2⤵
  PID:4644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
  2⤵
  PID:1128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/Analytic"
  2⤵
  PID:3380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
  2⤵
  PID:4020
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Cli/Analytic"
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
  2⤵
  PID:4372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
  2⤵
  PID:2256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dot3MM/Diagnostic"
  2⤵
  PID:4264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DucUpdateAgent/Operational"
  2⤵
  - Clears Windows event logs
  PID:4984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-API/Diagnostic"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Core/Diagnostic"
  2⤵
  PID:1208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
  2⤵
  PID:4532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
  2⤵
  PID:3104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Admin"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Operational"
  2⤵
  PID:2300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Contention"
  2⤵
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
  2⤵
  PID:1772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Power"
  2⤵
  PID:4628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Application-Learning/Admin"
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
  2⤵
  PID:2212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ESE/IODiagnose"
  2⤵
  PID:4088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ESE/Operational"
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-RasChap/Operational"
  2⤵
  PID:2372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-RasTls/Operational"
  2⤵
  PID:1268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-Sim/Operational"
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-Ttls/Operational"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
  2⤵
  PID:2544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
  2⤵
  PID:1776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
  2⤵
  PID:2160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
  2⤵
  PID:3840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
  2⤵
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Analytic"
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Operational"
  2⤵
  PID:3240
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
  2⤵
  PID:572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Debug"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
  2⤵
  PID:4860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Analytic"
  2⤵
  PID:3736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Debug"
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/WHC"
  2⤵
  PID:3684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Analytic"
  2⤵
  PID:2976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
  2⤵
  PID:4592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Debug"
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
  2⤵
  PID:5016
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Debug"
  2⤵
  PID:896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Analytic"
  2⤵
  PID:3476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Debug"
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
  2⤵
  PID:1668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
  2⤵
  PID:1564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
  2⤵
  PID:4440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
  2⤵
  PID:312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
  2⤵
  PID:644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GenericRoaming/Admin"
  2⤵
  PID:3336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
  2⤵
  PID:1696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
  2⤵
  PID:560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
  2⤵
  PID:3908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
  2⤵
  PID:4292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
  2⤵
  PID:2256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Operational"
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Help/Operational"
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
  2⤵
  PID:1188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
  2⤵
  PID:1624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"
  2⤵
  PID:980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Analytic"
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Operational"
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HttpService/Log"
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
  2⤵
  PID:4512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
  2⤵
  PID:2212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
  2⤵
  PID:4088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Admin"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Analytic"
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IE-SmartScreen"
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
  2⤵
  PID:2372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
  2⤵
  PID:1268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-Broker/Analytic"
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CandidateUI/Analytic"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
  2⤵
  PID:2544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPAPI/Analytic"
  2⤵
  PID:1776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPLMP/Analytic"
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPPRED/Analytic"
  2⤵
  PID:2160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPSetting/Analytic"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPTIP/Analytic"
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-KRAPI/Analytic"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-KRTIP/Analytic"
  2⤵
  PID:3840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TCCORE/Analytic"
  2⤵
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TCTIP/Analytic"
  2⤵
  PID:544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TIP/Analytic"
  2⤵
  PID:3960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPNAT/Diagnostic"
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
  2⤵
  PID:3292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Debug"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Operational"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IdCtrls/Analytic"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IdCtrls/Operational"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
  2⤵
  PID:656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-InputSwitch/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:1632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
  2⤵
  PID:3684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
  2⤵
  PID:2976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
  2⤵
  PID:4592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KdsSvc/Operational"
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos/Operational"
  2⤵
  PID:740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
  2⤵
  PID:1256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/General"
  2⤵
  PID:2936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/Performance"
  2⤵
  PID:2236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
  2⤵
  PID:2248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
  2⤵
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Operational"
  2⤵
  - Clears Windows event logs
  PID:3536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
  2⤵
  PID:3336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
  2⤵
  PID:1696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
  2⤵
  PID:1448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-IO/Operational"
  2⤵
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
  2⤵
  PID:3532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Operational"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
  2⤵
  PID:1208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
  2⤵
  PID:4220
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
  2⤵
  PID:364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
  2⤵
  PID:980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration"
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:5004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
  2⤵
  - Clears Windows event logs
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
  2⤵
  PID:4512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
  2⤵
  PID:4124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
  2⤵
  PID:2212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
  2⤵
  PID:4088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Performance"
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
  2⤵
  - Clears Windows event logs
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
  2⤵
  PID:2372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
  2⤵
  PID:1268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
  2⤵
  PID:2544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
  2⤵
  PID:1776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-XDV/Analytic"
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Admin"
  2⤵
  PID:2160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Operational"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Performance"
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
  2⤵
  PID:3840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Diagnostic"
  2⤵
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Operational"
  2⤵
  PID:544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Performance"
  2⤵
  PID:3960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
  2⤵
  PID:3292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LimitsManagement/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
  2⤵
  - Clears Windows event logs
  PID:656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LiveId/Analytic"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LiveId/Operational"
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
  2⤵
  PID:2976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
  2⤵
  PID:1768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
  2⤵
  PID:3536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
  2⤵
  PID:4264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
  2⤵
  PID:4984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMC"
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMR"
  2⤵
  PID:788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/MDE"
  2⤵
  PID:4516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
  2⤵
  PID:4980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
  2⤵
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
  2⤵
  PID:1772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Minstore/Analytic"
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Minstore/Debug"
  2⤵
  PID:2536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
  2⤵
  - Clears Windows event logs
  PID:384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational"
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
  2⤵
  PID:1380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
  2⤵
  - Clears Windows event logs
  PID:1052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
  2⤵
  PID:1028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mprddm/Operational"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
  2⤵
  PID:3636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
  2⤵
  PID:4672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
  2⤵
  PID:2792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ncasvc/Operational"
  2⤵
  PID:4028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Operational"
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NdisImPlatform/Operational"
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ndu/Diagnostic"
  2⤵
  PID:4552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
  2⤵
  PID:5012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-Connection-Broker"
  2⤵
  PID:2688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-DataUsage/Analytic"
  2⤵
  PID:2112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-Setup/Diagnostic"
  2⤵
  PID:3960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkBridge/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvider/Operational"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Analytic"
  2⤵
  PID:656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Operational"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkSecurity/Debug"
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkStatus/Analytic"
  2⤵
  PID:2976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
  2⤵
  - System Time Discovery
  PID:4440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
  2⤵
  PID:2248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/Operational"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/Performance"
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/WHC"
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLE/Clipboard-Performance"
  2⤵
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
  2⤵
  PID:1728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
  2⤵
  PID:1696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OcpUpdateAgent/Operational"
  2⤵
  PID:4516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
  2⤵
  - Clears Windows event logs
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneBackup/Debug"
  2⤵
  PID:4980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
  2⤵
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneX/Operational"
  2⤵
  PID:1772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
  2⤵
  - Clears Windows event logs
  PID:3212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OtpCredentialProvider/Operational"
  2⤵
  PID:2536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Analytic"
  2⤵
  PID:384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Debug"
  2⤵
  - Clears Windows event logs
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Operational"
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
  2⤵
  PID:116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Analytic"
  2⤵
  PID:1380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Diagnostic"
  2⤵
  PID:1052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PerceptionRuntime/Operational"
  2⤵
  PID:1028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
  2⤵
  PID:3636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
  2⤵
  PID:932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
  2⤵
  PID:2816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
  2⤵
  PID:2244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
  2⤵
  PID:4044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PhotoAcq/Analytic"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PlayToManager/Analytic"
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Policy/Analytic"
  2⤵
  PID:4552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Policy/Operational"
  2⤵
  PID:5012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
  2⤵
  PID:3440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Power-Meter-Polling/Diagnostic"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
  2⤵
  - Power Settings
  PID:1176
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
  2⤵
  PID:2468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
  2⤵
  PID:3736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
  2⤵
  PID:1652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
  2⤵
  PID:3100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Admin"
  2⤵
  PID:632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Debug"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintBRM/Admin"
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService-USBMon/Debug"
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
  2⤵
  PID:2568
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Privacy-Auditing/Operational"
  2⤵
  - Clears Windows event logs
  PID:4264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
  2⤵
  PID:788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
  2⤵
  PID:4516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Diagnostic"
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Informational"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Performance"
  2⤵
  - Clears Windows event logs
  PID:4980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Developer/Debug"
  2⤵
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-InProc/Debug"
  2⤵
  PID:1772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Admin"
  2⤵
  PID:2536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Debug"
  2⤵
  PID:384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Operational"
  2⤵
  PID:4496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
  2⤵
  PID:332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RRAS/Debug"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RRAS/Operational"
  2⤵
  PID:3632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RadioManager/Analytic"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Debug"
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Operational"
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReFS/Operational"
  2⤵
  PID:828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
  2⤵
  PID:984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
  2⤵
  PID:1808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
  2⤵
  PID:4048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
  2⤵
  PID:4552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Regsvr32/Operational"
  2⤵
  PID:5012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
  2⤵
  - Clears Windows event logs
  PID:3440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
  2⤵
  PID:1884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin"
  2⤵
  - Clears Windows event logs
  PID:4848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug"
  2⤵
  PID:3476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
  2⤵
  PID:632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
  2⤵
  PID:644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:1404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
  2⤵
  PID:560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RetailDemo/Admin"
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RetailDemo/Operational"
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Graphics/Analytic"
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Networking/Tracing"
  2⤵
  PID:2256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
  2⤵
  PID:3912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
  2⤵
  PID:364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime/CreateInstance"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime/Error"
  2⤵
  PID:1572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/Analytic"
  2⤵
  PID:3796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
  2⤵
  PID:1036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
  2⤵
  PID:1908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/Operational"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Admin"
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Debug"
  2⤵
  PID:748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Netmon"
  2⤵
  PID:2340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Analytic"
  2⤵
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Audit"
  2⤵
  PID:4052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Connectivity"
  2⤵
  PID:2932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Diagnostic"
  2⤵
  PID:2616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Operational"
  2⤵
  PID:5084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Performance"
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Security"
  2⤵
  PID:4116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Admin"
  2⤵
  PID:260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Informational"
  2⤵
  - Clears Windows event logs
  PID:4700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
  2⤵
  PID:1780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Schannel-Events/Perf"
  2⤵
  PID:1028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdbus/Analytic"
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdbus/Debug"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdstor/Analytic"
  2⤵
  PID:3636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SearchUI/Diagnostic"
  2⤵
  PID:4380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SearchUI/Operational"
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecureAssessment/Operational"
  2⤵
  PID:2544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Adminless/Operational"
  2⤵
  PID:1776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
  2⤵
  PID:2624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
  2⤵
  PID:540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
  2⤵
  PID:1148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-IdentityStore/Performance"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/KernelMode"
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/UserMode"
  2⤵
  PID:572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Netlogon/Operational"
  2⤵
  PID:4524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
  2⤵
  PID:3440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
  2⤵
  PID:1884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX/Analytic"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Vault/Performance"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
  2⤵
  PID:4848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
  2⤵
  PID:3476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SendTo/Diagnostic"
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
  2⤵
  PID:632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sensors/Debug"
  2⤵
  PID:644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sensors/Performance"
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
  2⤵
  - Clears Windows event logs
  PID:5072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
  2⤵
  PID:560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Servicing/Debug"
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync-Azure/Debug"
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync-Azure/Operational"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync-OneDrive/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync-OneDrive/Debug"
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync-OneDrive/Operational"
  2⤵
  PID:2312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync/Analytic"
  2⤵
  PID:3660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync/Debug"
  2⤵
  PID:1208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync/Operational"
  2⤵
  PID:4532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SettingSync/VerboseDebug"
  2⤵
  PID:788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
  2⤵
  PID:3516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
  2⤵
  PID:4040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupPlatform/Analytic"
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
  2⤵
  PID:3212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
  2⤵
  PID:364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"
  2⤵
  PID:3820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:2308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
  2⤵
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"
  2⤵
  PID:4052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
  2⤵
  PID:2044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"
  2⤵
  PID:4936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/ActionCenter"
  2⤵
  PID:3892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/AppDefaults"
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/Operational"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
  2⤵
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
  2⤵
  PID:5024
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
  2⤵
  PID:2448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"
  2⤵
  PID:1052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SleepStudy/Diagnostic"
  2⤵
  PID:2244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-Audit/Authentication"
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"
  2⤵
  PID:4028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"
  2⤵
  PID:1808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"
  2⤵
  PID:4048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartScreen/Debug"
  2⤵
  PID:4120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Audit"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Connectivity"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Diagnostic"
  2⤵
  PID:3292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Security"
  2⤵
  PID:2112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
  2⤵
  PID:1464
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Spellchecking-Host/Analytic"
  2⤵
  PID:1764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SruMon/Diagnostic"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SrumTelemetry"
  2⤵
  PID:1652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Debug"
  2⤵
  PID:1668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Diagnostic"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Operational"
  2⤵
  PID:4440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Restricted"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
  2⤵
  PID:3336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Admin"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Analytic"
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Debug"
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Diagnose"
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Operational"
  2⤵
  PID:1972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Admin"
  2⤵
  PID:1248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Analytic"
  2⤵
  PID:4188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Debug"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"
  2⤵
  PID:4160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Operational"
  2⤵
  PID:2980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Admin"
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Analytic"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Debug"
  2⤵
  PID:1616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Diagnose"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Operational"
  2⤵
  - Clears Windows event logs
  PID:224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Admin"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Analytic"
  2⤵
  PID:2636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Debug"
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Diagnose"
  2⤵
  PID:652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Health"
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Operational"
  2⤵
  PID:980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Tiering-IoHeat/Heat"
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Tiering/Admin"
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement/Debug"
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement/Operational"
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSettings/Diagnostic"
  2⤵
  PID:2340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Diagnostic"
  2⤵
  PID:3000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Operational"
  2⤵
  PID:2084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Performance"
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-ManagementAgent/WHC"
  2⤵
  PID:2760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic"
  2⤵
  PID:2212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Operational"
  2⤵
  PID:260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Store/Operational"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storsvc/Diagnostic"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
  2⤵
  PID:332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/Main"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/PfApLog"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-System-Profile-HardwareId/Diagnostic"
  2⤵
  PID:3712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsHandlers/Debug"
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Debug"
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Diagnostic"
  2⤵
  PID:4780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Operational"
  2⤵
  PID:4672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TCPIP/Operational"
  2⤵
  PID:4224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"
  2⤵
  PID:1148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"
  2⤵
  PID:3444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"
  2⤵
  PID:4552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TTS/Diagnostic"
  2⤵
  PID:5012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinAPI/Diagnostic"
  2⤵
  PID:572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinUI/Diagnostic"
  2⤵
  PID:3440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinUI/Operational"
  2⤵
  PID:4932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZSync/Analytic"
  2⤵
  PID:4204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZSync/Operational"
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"
  2⤵
  PID:4464
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"
  2⤵
  PID:3684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Maintenance"
  2⤵
  - Clears Windows event logs
  PID:3100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"
  2⤵
  PID:4812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
  2⤵
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
  2⤵
  PID:1584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
  2⤵
  PID:5072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
  2⤵
  PID:560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
  2⤵
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
  2⤵
  PID:3508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Admin"
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Analytic"
  2⤵
  PID:2892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Debug"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Operational"
  2⤵
  PID:3340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
  2⤵
  PID:4512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
  2⤵
  PID:3664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
  2⤵
  PID:3104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
  2⤵
  PID:4196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
  2⤵
  PID:1572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
  2⤵
  PID:1036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
  2⤵
  PID:2308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Tethering-Manager/Analytic"
  2⤵
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Tethering-Station/Analytic"
  2⤵
  PID:2632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"
  2⤵
  PID:2760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Threat-Intelligence/Analytic"
  2⤵
  PID:2212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational"
  2⤵
  PID:260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Time-Service/Operational"
  2⤵
  PID:60
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Admin"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Operational"
  2⤵
  PID:332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TunnelDriver"
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UAC/Operational"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UI-Shell/Diagnostic"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:4664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"
  2⤵
  - Clears Windows event logs
  PID:3712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
  2⤵
  PID:4476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"
  2⤵
  PID:2272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"
  2⤵
  PID:4780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-MAUSBHOST-Analytic"
  2⤵
  PID:4672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-UCX-Analytic"
  2⤵
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
  2⤵
  PID:1908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBHUB3-Analytic"
  2⤵
  PID:3876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
  2⤵
  PID:4964
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Analytic"
  2⤵
  PID:2420
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic"
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UniversalTelemetryClient/Operational"
  2⤵
  PID:4536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
  2⤵
  PID:3124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
  2⤵
  PID:4972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel/Diagnostic"
  2⤵
  PID:1808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel/Operational"
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Device Registration/Admin"
  2⤵
  - Clears Windows event logs
  PID:4808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Device Registration/Debug"
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"
  2⤵
  PID:5032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User-Loader/Operational"
  2⤵
  PID:4632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserAccountControl/Diagnostic"
  2⤵
  PID:4076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"
  2⤵
  PID:1100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/ActionCenter"
  2⤵
  PID:2688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceInstall"
  2⤵
  PID:3128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
  2⤵
  PID:3736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"
  2⤵
  - Clears Windows event logs
  PID:3808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"
  2⤵
  PID:1632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UxInit/Diagnostic"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VAN/Diagnostic"
  2⤵
  PID:4236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"
  2⤵
  PID:4812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VHDMP-Analytic"
  2⤵
  PID:1216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VHDMP-Operational"
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VIRTDISK-Analytic"
  2⤵
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VPN-Client/Operational"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VPN/Operational"
  2⤵
  PID:1584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:5072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Admin"
  2⤵
  PID:3952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Operational"
  2⤵
  PID:2676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Volume/Diagnostic"
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Analytic"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
  2⤵
  PID:5080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"
  2⤵
  PID:4484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"
  2⤵
  PID:2892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WCNWiz/Analytic"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WEPHOSTSVC/Operational"
  2⤵
  PID:3340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WER-PayloadHealth/Operational"
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WFP/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WFP/Operational"
  2⤵
  - Clears Windows event logs
  PID:3664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WLAN-AutoConfig/Operational"
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"
  2⤵
  PID:3104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WLAN-Driver/Analytic"
  2⤵
  PID:4196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WLAN-MediaManager/Diagnostic"
  2⤵
  PID:1572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"
  2⤵
  PID:5056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Debug"
  2⤵
  PID:1036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Operational"
  2⤵
  PID:3732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Trace"
  2⤵
  PID:2308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMPDMCUI/Diagnostic"
  2⤵
  PID:3740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"
  2⤵
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Operational"
  2⤵
  PID:2632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WMPNSSUI/Diagnostic"
  2⤵
  PID:1520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-API/Analytic"
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"
  2⤵
  - Clears Windows event logs
  PID:116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Operational"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"
  2⤵
  PID:1268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"
  2⤵
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-MTPBT/Analytic"
  2⤵
  PID:332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Analytic"
  2⤵
  PID:3228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-MTPIP/Analytic"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WPD-MTPUS/Analytic"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WSC-SRV/Diagnostic"
  2⤵
  PID:4664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WUSA/Debug"
  2⤵
  PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads