0cfa0ac908cb962bd283fdf4fb008e95d54394e5ff0d206c35e1bf9cdd6ad0a2

Analysis

user interaction
yes
max time kernel
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACK/HELPERS/CleanSystem/JurnalClear.bat
Size 9KB
Sample260706-ts5npadt3k
SHA256 0cfa0ac908cb962bd283fdf4fb008e95d54394e5ff0d206c35e1bf9cdd6ad0a2
MD5 94451f678eb3872903c7984feb1c8ab3
SHA1 74f2037b3ed35cfcca1a73f2145b0de522b0fd2b
SHA512 4a53708bee5e41d73e1aa7264b690cd9544cde6a952284e743a0670c547c1290431f5cb42dcf62aeee26390fde4b7a5db0d46b7086ebd50dbeb90280732013d9
SSDEEP 96:gDf2GF6s+jRa1xwOw8sSr0T81Z1W1y1z1+dbJK4irfkJe0xH1Tcxv7xZeZancZ0T:Cf2s6sHbW8keMHucACvjjFoH
TLSH
T1561222805CDD851292D1F7623B6B8921C3BBB685AD189B9B48CC0A20591EECDC17E1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3996	wevtutil.exe
4592	wevtutil.exe
2904	wevtutil.exe
3172	wevtutil.exe
2600	wevtutil.exe
5284	Process not Found
1396	wevtutil.exe
5172	wevtutil.exe
6060	wevtutil.exe
3448	wevtutil.exe
5484	wevtutil.exe
1284	wevtutil.exe
4736	Process not Found
1160	wevtutil.exe
3876	wevtutil.exe
4608	wevtutil.exe
1380	wevtutil.exe
4244	wevtutil.exe
2392	wevtutil.exe
5596	wevtutil.exe
4772	wevtutil.exe
6048	Process not Found
3216	wevtutil.exe
4200	wevtutil.exe
1760	wevtutil.exe
1512	wevtutil.exe
5856	wevtutil.exe
5388	Process not Found
3968	wevtutil.exe
3724	wevtutil.exe
2784	Process not Found
6008	wevtutil.exe
2076	wevtutil.exe
3068	wevtutil.exe
5532	wevtutil.exe
1144	Process not Found
1780	wevtutil.exe
2860	wevtutil.exe
5716	wevtutil.exe
5628	wevtutil.exe
5284	wevtutil.exe
2252	wevtutil.exe
3704	wevtutil.exe
3688	wevtutil.exe
2144	wevtutil.exe
4392	wevtutil.exe
3572	Process not Found
4732	wevtutil.exe
4348	wevtutil.exe
4616	wevtutil.exe
6076	wevtutil.exe
1544	wevtutil.exe
1212	wevtutil.exe
1336	Process not Found
5972	Process not Found
4812	wevtutil.exe
1204	wevtutil.exe
5948	wevtutil.exe
5432	wevtutil.exe
3920	wevtutil.exe
248	wevtutil.exe
1744	wevtutil.exe
4216	wevtutil.exe
5600	wevtutil.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2920	wevtutil.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3924	wevtutil.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1284	ipconfig.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key deleted	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1104	wevtutil.exe
Token: SeBackupPrivilege	1104	wevtutil.exe
Token: SeSecurityPrivilege	1788	wevtutil.exe
Token: SeBackupPrivilege	1788	wevtutil.exe
Token: SeSecurityPrivilege	5896	wevtutil.exe
Token: SeBackupPrivilege	5896	wevtutil.exe
Token: SeSecurityPrivilege	3172	wevtutil.exe
Token: SeBackupPrivilege	3172	wevtutil.exe
Token: SeSecurityPrivilege	5432	wevtutil.exe
Token: SeBackupPrivilege	5432	wevtutil.exe
Token: SeSecurityPrivilege	2836	wevtutil.exe
Token: SeBackupPrivilege	2836	wevtutil.exe
Token: SeSecurityPrivilege	4752	wevtutil.exe
Token: SeBackupPrivilege	4752	wevtutil.exe
Token: SeSecurityPrivilege	712	wevtutil.exe
Token: SeBackupPrivilege	712	wevtutil.exe
Token: SeSecurityPrivilege	3444	wevtutil.exe
Token: SeBackupPrivilege	3444	wevtutil.exe
Token: SeSecurityPrivilege	4876	wevtutil.exe
Token: SeBackupPrivilege	4876	wevtutil.exe
Token: SeSecurityPrivilege	1672	wevtutil.exe
Token: SeBackupPrivilege	1672	wevtutil.exe
Token: SeSecurityPrivilege	1336	wevtutil.exe
Token: SeBackupPrivilege	1336	wevtutil.exe
Token: SeSecurityPrivilege	3424	wevtutil.exe
Token: SeBackupPrivilege	3424	wevtutil.exe
Token: SeSecurityPrivilege	528	wevtutil.exe
Token: SeBackupPrivilege	528	wevtutil.exe
Token: SeSecurityPrivilege	1744	wevtutil.exe
Token: SeBackupPrivilege	1744	wevtutil.exe
Token: SeSecurityPrivilege	1144	wevtutil.exe
Token: SeBackupPrivilege	1144	wevtutil.exe
Token: SeSecurityPrivilege	552	wevtutil.exe
Token: SeBackupPrivilege	552	wevtutil.exe
Token: SeSecurityPrivilege	5048	wevtutil.exe
Token: SeBackupPrivilege	5048	wevtutil.exe
Token: SeSecurityPrivilege	5472	wevtutil.exe
Token: SeBackupPrivilege	5472	wevtutil.exe
Token: SeSecurityPrivilege	1600	wevtutil.exe
Token: SeBackupPrivilege	1600	wevtutil.exe
Token: SeSecurityPrivilege	5532	wevtutil.exe
Token: SeBackupPrivilege	5532	wevtutil.exe
Token: SeSecurityPrivilege	3692	wevtutil.exe
Token: SeBackupPrivilege	3692	wevtutil.exe
Token: SeSecurityPrivilege	5096	wevtutil.exe
Token: SeBackupPrivilege	5096	wevtutil.exe
Token: SeSecurityPrivilege	2424	wevtutil.exe
Token: SeBackupPrivilege	2424	wevtutil.exe
Token: SeSecurityPrivilege	4012	wevtutil.exe
Token: SeBackupPrivilege	4012	wevtutil.exe
Token: SeSecurityPrivilege	5028	wevtutil.exe
Token: SeBackupPrivilege	5028	wevtutil.exe
Token: SeSecurityPrivilege	3996	wevtutil.exe
Token: SeBackupPrivilege	3996	wevtutil.exe
Token: SeSecurityPrivilege	5836	wevtutil.exe
Token: SeBackupPrivilege	5836	wevtutil.exe
Token: SeSecurityPrivilege	4344	wevtutil.exe
Token: SeBackupPrivilege	4344	wevtutil.exe
Token: SeSecurityPrivilege	2940	wevtutil.exe
Token: SeBackupPrivilege	2940	wevtutil.exe
Token: SeSecurityPrivilege	3520	wevtutil.exe
Token: SeBackupPrivilege	3520	wevtutil.exe
Token: SeSecurityPrivilege	2924	wevtutil.exe
Token: SeBackupPrivilege	2924	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 1284	3776	cmd.exe	89
PID 3776 wrote to memory of 5368	3776	cmd.exe	90
PID 3776 wrote to memory of 2740	3776	cmd.exe	91
PID 2740 wrote to memory of 2444	2740	cmd.exe	92
PID 3776 wrote to memory of 3656	3776	cmd.exe	93
PID 3656 wrote to memory of 1104	3656	cmd.exe	94
PID 3776 wrote to memory of 1788	3776	cmd.exe	95
PID 3776 wrote to memory of 5896	3776	cmd.exe	96
PID 3776 wrote to memory of 3172	3776	cmd.exe	97
PID 3776 wrote to memory of 5432	3776	cmd.exe	98
PID 3776 wrote to memory of 2836	3776	cmd.exe	99
PID 3776 wrote to memory of 4752	3776	cmd.exe	100
PID 3776 wrote to memory of 712	3776	cmd.exe	101
PID 3776 wrote to memory of 3444	3776	cmd.exe	102
PID 3776 wrote to memory of 4876	3776	cmd.exe	103
PID 3776 wrote to memory of 1672	3776	cmd.exe	104
PID 3776 wrote to memory of 1336	3776	cmd.exe	105
PID 3776 wrote to memory of 3424	3776	cmd.exe	106
PID 3776 wrote to memory of 528	3776	cmd.exe	107
PID 3776 wrote to memory of 1744	3776	cmd.exe	108
PID 3776 wrote to memory of 1144	3776	cmd.exe	109
PID 3776 wrote to memory of 552	3776	cmd.exe	110
PID 3776 wrote to memory of 5048	3776	cmd.exe	111
PID 3776 wrote to memory of 5472	3776	cmd.exe	112
PID 3776 wrote to memory of 1600	3776	cmd.exe	113
PID 3776 wrote to memory of 5532	3776	cmd.exe	114
PID 3776 wrote to memory of 3692	3776	cmd.exe	115
PID 3776 wrote to memory of 5096	3776	cmd.exe	116
PID 3776 wrote to memory of 2424	3776	cmd.exe	117
PID 3776 wrote to memory of 4012	3776	cmd.exe	118
PID 3776 wrote to memory of 5028	3776	cmd.exe	119
PID 3776 wrote to memory of 3996	3776	cmd.exe	120
PID 3776 wrote to memory of 5836	3776	cmd.exe	121
PID 3776 wrote to memory of 4344	3776	cmd.exe	122
PID 3776 wrote to memory of 2940	3776	cmd.exe	123
PID 3776 wrote to memory of 3520	3776	cmd.exe	124
PID 3776 wrote to memory of 2924	3776	cmd.exe	125
PID 3776 wrote to memory of 3872	3776	cmd.exe	126
PID 3776 wrote to memory of 2612	3776	cmd.exe	127
PID 3776 wrote to memory of 3276	3776	cmd.exe	128
PID 3776 wrote to memory of 2088	3776	cmd.exe	129
PID 3776 wrote to memory of 4300	3776	cmd.exe	130
PID 3776 wrote to memory of 5816	3776	cmd.exe	131
PID 3776 wrote to memory of 6092	3776	cmd.exe	132
PID 3776 wrote to memory of 5956	3776	cmd.exe	133
PID 3776 wrote to memory of 3488	3776	cmd.exe	134
PID 3776 wrote to memory of 3396	3776	cmd.exe	135
PID 3776 wrote to memory of 3524	3776	cmd.exe	136
PID 3776 wrote to memory of 6132	3776	cmd.exe	137
PID 3776 wrote to memory of 2012	3776	cmd.exe	138
PID 3776 wrote to memory of 5968	3776	cmd.exe	139
PID 3776 wrote to memory of 3904	3776	cmd.exe	140
PID 3776 wrote to memory of 2268	3776	cmd.exe	141
PID 3776 wrote to memory of 2632	3776	cmd.exe	142
PID 3776 wrote to memory of 4820	3776	cmd.exe	143
PID 3776 wrote to memory of 5272	3776	cmd.exe	144
PID 3776 wrote to memory of 5112	3776	cmd.exe	145
PID 3776 wrote to memory of 5660	3776	cmd.exe	146
PID 3776 wrote to memory of 3316	3776	cmd.exe	147
PID 3776 wrote to memory of 2468	3776	cmd.exe	148
PID 3776 wrote to memory of 3156	3776	cmd.exe	149
PID 3776 wrote to memory of 1948	3776	cmd.exe	150
PID 3776 wrote to memory of 2616	3776	cmd.exe	151
PID 3776 wrote to memory of 1356	3776	cmd.exe	152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\CleanSystem\JurnalClear.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\system32\ipconfig.exe
  ipconfig / releaseipconfig / renewipconfig / flushdns
  2⤵
  - Gathers network information
  PID:1284
- C:\Windows\system32\chcp.com
  CHCP 866
  2⤵
  PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\bcdedit.exe
    bcdedit
    3⤵
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wevtutil.exe el
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "AMSI/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "AirSpaceChannel"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Application"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "DirectShowFilterGraph"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "DirectShowPluginControl"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Els_Hyphenation/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "EndpointMapper"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "FirstUXPerf-Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "ForwardedEvents"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "General Logging"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "HardwareEvents"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "IHM_DebugChannel"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:528
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Internet Explorer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Key Management Service"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_DshowReverseBridge"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationFrameServer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MedaFoundationVideoProc"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MedaFoundationVideoProcD3D"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationAsyncWrapper"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationContentProtection"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationDS"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationDeviceProxy"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationMP4"
  2⤵
  PID:3872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationMediaEngine"
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPerformance"
  2⤵
  PID:3276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPerformanceCore"
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPipeline"
  2⤵
  PID:4300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPlatform"
  2⤵
  PID:5816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationSrcPrefetch"
  2⤵
  PID:6092
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Admin"
  2⤵
  PID:3488
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Debug"
  2⤵
  PID:3396
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Operational"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"
  2⤵
  PID:6132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"
  2⤵
  PID:2012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-License-Flexible-Platform/Admin"
  2⤵
  PID:5968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-License-Flexible-Platform/Debug"
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-License-Flexible-Platform/Diagnostic"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"
  2⤵
  PID:2632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"
  2⤵
  PID:4820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"
  2⤵
  PID:5272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-IE/Diagnostic"
  2⤵
  PID:5112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
  2⤵
  PID:5660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"
  2⤵
  PID:2468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
  2⤵
  PID:3156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
  2⤵
  PID:1948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"
  2⤵
  PID:2616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"
  2⤵
  PID:1356
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
  2⤵
  PID:6088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"
  2⤵
  PID:252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"
  2⤵
  PID:1124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
  2⤵
  PID:5828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
  2⤵
  PID:1852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AAD/Analytic"
  2⤵
  PID:1508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AAD/Operational"
  2⤵
  PID:2132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ASN1/Operational"
  2⤵
  PID:3324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
  2⤵
  PID:1112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
  2⤵
  PID:3440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AccelLib-AccelCx/Operational"
  2⤵
  PID:2816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"
  2⤵
  PID:4900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Admin"
  2⤵
  PID:6028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"
  2⤵
  PID:2452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"
  2⤵
  PID:1292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Internal"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
  2⤵
  PID:1848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
  2⤵
  PID:4868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
  2⤵
  PID:5160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
  2⤵
  PID:1076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
  2⤵
  PID:6100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Verbose"
  2⤵
  PID:3124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"
  2⤵
  PID:4800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"
  2⤵
  PID:3096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"
  2⤵
  PID:2808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"
  2⤵
  PID:5388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"
  2⤵
  - Clears Windows event logs
  PID:1780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"
  2⤵
  PID:2100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppSruProv"
  2⤵
  PID:1048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:5628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"
  2⤵
  PID:3932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"
  2⤵
  PID:5624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:4592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"
  2⤵
  PID:2512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
  2⤵
  PID:4980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
  2⤵
  PID:3536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
  2⤵
  PID:4268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
  2⤵
  PID:3328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
  2⤵
  - Clears Windows event logs
  PID:2904
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
  2⤵
  - Clears Windows event logs
  PID:2860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
  2⤵
  - Clears Windows event logs
  PID:5284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
  2⤵
  PID:5556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Debug"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Operational"
  2⤵
  PID:4976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Performance"
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Admin"
  2⤵
  PID:1352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Operational"
  2⤵
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Admin"
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Operational"
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AsynchronousCausality/Causality"
  2⤵
  PID:3020
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/GlitchDetection"
  2⤵
  PID:3588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Informational"
  2⤵
  PID:692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
  2⤵
  PID:4932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
  2⤵
  PID:3272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/PlaybackManager"
  2⤵
  PID:5996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
  2⤵
  PID:5608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
  2⤵
  PID:5116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
  2⤵
  PID:5712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
  2⤵
  PID:5872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
  2⤵
  PID:5916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/HCI"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Performance"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
  2⤵
  PID:5484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
  2⤵
  PID:1256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Backup"
  2⤵
  PID:6140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
  2⤵
  PID:5168
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
  2⤵
  PID:1984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Battery/Diagnostic"
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Biometrics/Analytic"
  2⤵
  PID:2060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
  2⤵
  PID:1108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
  2⤵
  PID:5552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
  2⤵
  PID:2912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Management"
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Operational"
  2⤵
  PID:2936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/Tracing"
  2⤵
  PID:3940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
  2⤵
  PID:2784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
  2⤵
  PID:1448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
  2⤵
  PID:1332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
  2⤵
  - Clears Windows event logs
  PID:1760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-Policy/Operational"
  2⤵
  PID:1676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
  2⤵
  PID:2932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
  2⤵
  PID:4796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
  2⤵
  PID:4812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
  2⤵
  PID:5752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
  2⤵
  PID:3408
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
  2⤵
  PID:3296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
  2⤵
  PID:5256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
  2⤵
  PID:2328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
  2⤵
  PID:2688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
  2⤵
  PID:5544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ApartmentInitialize"
  2⤵
  PID:5840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ApartmentUninitialize"
  2⤵
  PID:5224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/Call"
  2⤵
  PID:3572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/CreateInstance"
  2⤵
  PID:5212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ExtensionCatalog"
  2⤵
  PID:1792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/FreeUnusedLibrary"
  2⤵
  - Clears Windows event logs
  PID:3920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/RundownInstrumentation"
  2⤵
  PID:4448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/Activations"
  2⤵
  PID:2564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/MessageProcessing"
  2⤵
  PID:704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
  2⤵
  PID:5856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Calculator/Debug"
  2⤵
  PID:2412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
  2⤵
  PID:1916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
  2⤵
  PID:2780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
  2⤵
  PID:4300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
  2⤵
  - Clears Windows event logs
  PID:3448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Cleanmgr/Diagnostic"
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:1160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudFiles-Filter/Debug"
  2⤵
  PID:2796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudFiles-Filter/Operational"
  2⤵
  PID:2236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudRestoreLauncher/Operational"
  2⤵
  PID:5848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Debug"
  2⤵
  - Clears Windows event logs
  PID:1396
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Initialization"
  2⤵
  PID:1416
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Operational"
  2⤵
  PID:5500
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
  2⤵
  PID:5892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Analytic"
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Operational"
  2⤵
  PID:4940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Debug"
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Operational"
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Debug"
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Operational"
  2⤵
  PID:2960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Diagnostic"
  2⤵
  PID:1708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Operational"
  2⤵
  PID:6084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Tracing"
  2⤵
  PID:6104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
  2⤵
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
  2⤵
  - Clears Windows event logs
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreWindow/Analytic"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreWindow/Debug"
  2⤵
  - Clears Windows event logs
  PID:5948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
  2⤵
  PID:1028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crashdump/Analytic"
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crashdump/Operational"
  2⤵
  PID:5824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-CNG/Analytic"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Debug"
  2⤵
  PID:4428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Operational"
  2⤵
  PID:3636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
  2⤵
  PID:5656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/CertInUse"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/KeyMgmt"
  2⤵
  PID:4444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/Operational"
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
  2⤵
  PID:4180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
  2⤵
  PID:624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
  2⤵
  PID:1588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
  2⤵
  PID:3628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Analytic"
  2⤵
  - Clears Windows event logs
  PID:5172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Operational"
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
  2⤵
  PID:3468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DDisplay/Analytic"
  2⤵
  PID:5668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DDisplay/Logging"
  2⤵
  PID:1864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DLNA-Namespace/Analytic"
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
  2⤵
  PID:6000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Admin"
  2⤵
  PID:5804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Analytic"
  2⤵
  PID:808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Debug"
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Operational"
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
  2⤵
  PID:1384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
  2⤵
  PID:2868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
  2⤵
  PID:5624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
  2⤵
  PID:4592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Data-Pdf/Debug"
  2⤵
  - Clears Windows event logs
  PID:2252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/Admin"
  2⤵
  PID:2068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
  2⤵
  PID:5620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
  2⤵
  PID:780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
  2⤵
  PID:5992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
  2⤵
  PID:1700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Diagnostic"
  2⤵
  PID:2992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Operational"
  2⤵
  PID:1496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Performance"
  2⤵
  PID:1800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Scrubbing"
  2⤵
  PID:4364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Defrag-Core/Debug"
  2⤵
  PID:5664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
  2⤵
  PID:3420
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
  2⤵
  PID:2916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceAssociationService/Performance"
  2⤵
  PID:2812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceConfidence/Analytic"
  2⤵
  PID:2448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Operational"
  2⤵
  PID:3948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Verbose"
  2⤵
  PID:2588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
  2⤵
  - Clears Windows event logs
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot"
  2⤵
  PID:4108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
  2⤵
  PID:3976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Admin"
  2⤵
  - Clears Windows event logs
  PID:1380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Analytic"
  2⤵
  PID:5600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Debug"
  2⤵
  PID:4872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Operational"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
  2⤵
  PID:3588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
  2⤵
  PID:692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
  2⤵
  PID:4932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
  2⤵
  PID:3272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Devices-Background/Operational"
  2⤵
  PID:5768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Devices-Query/Performance"
  2⤵
  PID:4272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
  2⤵
  PID:5568
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
  2⤵
  - Clears Windows event logs
  PID:4244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
  2⤵
  PID:1156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
  2⤵
  PID:2352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
  2⤵
  PID:2652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
  2⤵
  PID:5480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
  2⤵
  PID:1360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
  2⤵
  PID:1284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
  2⤵
  PID:2444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
  2⤵
  PID:5208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
  2⤵
  PID:2060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
  2⤵
  PID:1108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
  2⤵
  PID:5552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
  2⤵
  PID:5200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
  2⤵
  PID:2336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
  2⤵
  PID:3444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
  2⤵
  PID:4876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
  2⤵
  PID:1336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
  2⤵
  PID:3424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
  2⤵
  PID:1760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:1744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
  2⤵
  PID:4996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
  2⤵
  PID:5752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
  2⤵
  PID:5972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
  2⤵
  PID:5532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/Analytic"
  2⤵
  PID:3692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/Logging"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/PerfTiming"
  2⤵
  PID:2424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D9/Analytic"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3DShaderCache/Default"
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectComposition/Diagnostic"
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectManipulation/Diagnostic"
  2⤵
  PID:5836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
  2⤵
  PID:4344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
  2⤵
  PID:2940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
  2⤵
  PID:2924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
  2⤵
  PID:5720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/Analytic"
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
  2⤵
  PID:3284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
  2⤵
  - Clears Windows event logs
  PID:6008
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Cli/Analytic"
  2⤵
  PID:4300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
  2⤵
  PID:3488
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
  2⤵
  PID:3396
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
  2⤵
  PID:3524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
  2⤵
  PID:6132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverProxy/Operational"
  2⤵
  PID:2012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverProxy/Performance"
  2⤵
  PID:5968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-API/Diagnostic"
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Compositor/Diagnostic"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Core/Diagnostic"
  2⤵
  PID:2632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
  2⤵
  PID:2752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
  2⤵
  PID:5880
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
  2⤵
  PID:4740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Admin"
  2⤵
  PID:2840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Operational"
  2⤵
  PID:2468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-SysMm/Debug"
  2⤵
  PID:3156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-SysMm/Performance"
  2⤵
  PID:1948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Contention"
  2⤵
  PID:2616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
  2⤵
  PID:1356
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
  2⤵
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Power"
  2⤵
  PID:6088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Application-Learning/Admin"
  2⤵
  PID:252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
  2⤵
  PID:1124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
  2⤵
  PID:1920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EFS/Operational"
  2⤵
  PID:5828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ESE/IODiagnose"
  2⤵
  PID:1852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ESE/Operational"
  2⤵
  PID:1508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
  2⤵
  PID:5976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
  2⤵
  PID:1468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
  2⤵
  PID:3460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-RasChap/Operational"
  2⤵
  PID:2852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-RasTls/Operational"
  2⤵
  PID:4900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-Sim/Operational"
  2⤵
  PID:6028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-Ttls/Operational"
  2⤵
  PID:2452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
  2⤵
  PID:1292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
  2⤵
  PID:5528
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorClass/Operational"
  2⤵
  PID:5812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
  2⤵
  PID:5160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
  2⤵
  PID:5380
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
  2⤵
  PID:1588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
  2⤵
  PID:3628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
  2⤵
  PID:5172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
  2⤵
  PID:3916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
  2⤵
  PID:2548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
  2⤵
  PID:2044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Operational"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
  2⤵
  PID:5388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Analytic"
  2⤵
  PID:5804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Operational"
  2⤵
  PID:808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
  2⤵
  PID:4248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Debug"
  2⤵
  PID:1384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
  2⤵
  PID:3160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
  2⤵
  PID:1212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Analytic"
  2⤵
  PID:5364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Debug"
  2⤵
  PID:2944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/WHC"
  2⤵
  PID:1280
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Analytic"
  2⤵
  PID:5132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Debug"
  2⤵
  PID:2472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
  2⤵
  PID:3716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Debug"
  2⤵
  PID:5992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Analytic"
  2⤵
  PID:556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Debug"
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
  2⤵
  PID:3724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
  2⤵
  - Clears Windows event logs
  PID:4216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
  2⤵
  PID:2872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
  2⤵
  PID:2540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
  2⤵
  PID:6056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
  2⤵
  PID:5136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GenericRoaming/Admin"
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
  2⤵
  PID:2588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
  2⤵
  PID:3492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
  2⤵
  PID:1824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Debug"
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Operational"
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Help/Operational"
  2⤵
  PID:1968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
  2⤵
  PID:5744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Analytic"
  2⤵
  PID:1592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Operational"
  2⤵
  - Clears Windows event logs
  PID:4732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HttpService/Log"
  2⤵
  PID:3392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
  2⤵
  PID:5116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
  2⤵
  PID:5712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
  2⤵
  PID:5872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
  2⤵
  PID:4200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
  2⤵
  PID:6032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
  2⤵
  PID:1132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-KMCL-Child/Analytic"
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Admin"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Analytic"
  2⤵
  PID:2896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IE-SmartScreen"
  2⤵
  - Clears Windows event logs
  PID:5484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
  2⤵
  PID:1256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
  2⤵
  - Clears Windows event logs
  PID:3968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-Broker/Analytic"
  2⤵
  PID:5168
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CandidateUI/Analytic"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
  2⤵
  PID:1060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPAPI/Analytic"
  2⤵
  - Clears Windows event logs
  PID:3172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPLMP/Analytic"
  2⤵
  PID:5792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPPRED/Analytic"
  2⤵
  PID:5392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPSetting/Analytic"
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPTIP/Analytic"
  2⤵
  PID:2936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-KRAPI/Analytic"
  2⤵
  PID:4600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-KRTIP/Analytic"
  2⤵
  PID:4424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
  2⤵
  PID:4876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TCCORE/Analytic"
  2⤵
  PID:2500
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TCTIP/Analytic"
  2⤵
  PID:1336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TIP/Analytic"
  2⤵
  PID:3424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPNAT/Diagnostic"
  2⤵
  PID:1760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
  2⤵
  PID:5920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Debug"
  2⤵
  PID:4992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Operational"
  2⤵
  PID:4796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IdCtrls/Analytic"
  2⤵
  PID:3924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IdCtrls/Operational"
  2⤵
  PID:804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
  2⤵
  PID:1272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-InputSwitch/Diagnostic"
  2⤵
  PID:6076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
  2⤵
  PID:5540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
  2⤵
  PID:4012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KdsSvc/Operational"
  2⤵
  PID:1488
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational"
  2⤵
  PID:3688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance"
  2⤵
  PID:3236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos/Operational"
  2⤵
  PID:3784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
  2⤵
  PID:4720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/General"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/Performance"
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
  2⤵
  PID:5596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
  2⤵
  PID:5856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
  2⤵
  PID:2412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
  2⤵
  PID:3464
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Operational"
  2⤵
  PID:5496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
  2⤵
  PID:5816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-CPU-Partition/Analytic"
  2⤵
  PID:5268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-CPU-Starvation/Operational"
  2⤵
  - Clears Windows event logs
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Cache/Operational"
  2⤵
  - Clears Windows event logs
  PID:2600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
  2⤵
  PID:2800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Dump/Operational"
  2⤵
  PID:5476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
  2⤵
  PID:2076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
  2⤵
  PID:1204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
  2⤵
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-IO/Operational"
  2⤵
  PID:3064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
  2⤵
  PID:2972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
  2⤵
  PID:2280
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
  2⤵
  PID:5080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Operational"
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PRM/Operational"
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
  2⤵
  PID:1264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
  2⤵
  PID:2440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration"
  2⤵
  PID:2144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
  2⤵
  PID:4604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
  2⤵
  PID:6104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Management"
  2⤵
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
  2⤵
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
  2⤵
  PID:5868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
  2⤵
  PID:5824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Performance"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
  2⤵
  PID:4428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
  2⤵
  PID:4368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
  2⤵
  PID:1544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
  2⤵
  PID:5100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
  2⤵
  PID:6060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-XDV/Analytic"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Admin"
  2⤵
  PID:5156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Operational"
  2⤵
  PID:3124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Performance"
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
  2⤵
  - Clears Windows event logs
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
  2⤵
  PID:5668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LAPS/Operational"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Diagnostic"
  2⤵
  PID:1548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Operational"
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Performance"
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
  2⤵
  PID:4432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
  2⤵
  PID:5860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
  2⤵
  PID:5124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LimitsManagement/Diagnostic"
  2⤵
  PID:3932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
  2⤵
  PID:2140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
  2⤵
  PID:1412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LiveId/Analytic"
  2⤵
  PID:2552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LiveId/Operational"
  2⤵
  PID:4592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LocationServiceProvider/Debug"
  2⤵
  PID:2252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
  2⤵
  PID:3708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
  2⤵
  PID:780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
  2⤵
  PID:5456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
  2⤵
  PID:5264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
  2⤵
  - Clears Windows event logs
  PID:1512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
  2⤵
  PID:1084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
  2⤵
  PID:5864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
  2⤵
  PID:6016
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
  2⤵
  PID:2292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMC"
  2⤵
  PID:2812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMR"
  2⤵
  PID:2448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/MDE"
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
  2⤵
  PID:3068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
  2⤵
  PID:3492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
  2⤵
  PID:1824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Minstore/Analytic"
  2⤵
  PID:3036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Minstore/Debug"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
  2⤵
  PID:6136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
  2⤵
  PID:916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
  2⤵
  PID:5924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
  2⤵
  PID:5608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
  2⤵
  - Clears Windows event logs
  PID:5716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
  2⤵
  PID:5768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
  2⤵
  PID:4272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics"
  2⤵
  PID:2276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
  2⤵
  PID:5916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MosHost/Operational"
  2⤵
  PID:6052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MosHost/Performance"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mprddm/Operational"
  2⤵
  PID:1296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
  2⤵
  PID:2652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
  2⤵
  PID:5480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
  2⤵
  PID:1360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
  2⤵
  - Clears Windows event logs
  PID:1284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
  2⤵
  PID:4704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
  2⤵
  PID:2444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
  2⤵
  PID:1984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ncasvc/Operational"
  2⤵
  PID:1452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
  2⤵
  PID:5896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Operational"
  2⤵
  PID:1616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NdisImPlatform/Operational"
  2⤵
  PID:5432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ndu/Diagnostic"
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
  2⤵
  PID:2804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-Connection-Broker"
  2⤵
  PID:4148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-ExecutionContext/Operational"
  2⤵
  PID:3940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-Setup/Diagnostic"
  2⤵
  PID:2772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
  2⤵
  PID:884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkBridge/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:2392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
  2⤵
  PID:1484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvider/Operational"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Analytic"
  2⤵
  PID:1744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Operational"
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkSecurity/Debug"
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
  2⤵
  PID:4796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
  2⤵
  - System Time Discovery
  PID:3924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
  2⤵
  PID:804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/Operational"
  2⤵
  PID:1272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/Performance"
  2⤵
  PID:6076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/WHC"
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLE/Clipboard-Performance"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
  2⤵
  PID:5540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
  2⤵
  PID:4012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
  2⤵
  PID:1488
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
  2⤵
  PID:3236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
  2⤵
  PID:3784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
  2⤵
  PID:4720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
  2⤵
  - Clears Windows event logs
  PID:5596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
  2⤵
  - Clears Windows event logs
  PID:5856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneBackup/Debug"
  2⤵
  PID:2412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
  2⤵
  PID:3464
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneX/Operational"
  2⤵
  PID:5496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
  2⤵
  PID:5816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OtpCredentialProvider/Operational"
  2⤵
  PID:5268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
  2⤵
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PCI/Operational"
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
  2⤵
  PID:2800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Analytic"
  2⤵
  PID:5476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Debug"
  2⤵
  - Clears Windows event logs
  PID:2076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Diagnostic"
  2⤵
  PID:1204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PerceptionRuntime/Operational"
  2⤵
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
  2⤵
  PID:3064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Perflib/Operational"
  2⤵
  PID:2972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
  2⤵
  PID:2280
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
  2⤵
  PID:5080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
  2⤵
  PID:1264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
  2⤵
  PID:2440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
  2⤵
  PID:2144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PhotoAcq/Analytic"
  2⤵
  PID:4604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PlayToManager/Analytic"
  2⤵
  PID:6104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Policy/Analytic"
  2⤵
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Policy/Operational"
  2⤵
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
  2⤵
  - Power Settings
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
  2⤵
  PID:5868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
  2⤵
  PID:5824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
  2⤵
  - Clears Windows event logs
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Admin"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Debug"
  2⤵
  PID:4428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintBRM/Admin"
  2⤵
  PID:4368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService-USBMon/Debug"
  2⤵
  PID:1544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
  2⤵
  PID:5100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode/Operational"
  2⤵
  PID:6060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Privacy-Auditing/Operational"
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
  2⤵
  PID:5156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
  2⤵
  PID:3124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
  2⤵
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
  2⤵
  PID:5668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Diagnostic"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Informational"
  2⤵
  PID:1548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Performance"
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Developer/Debug"
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-InProc/Debug"
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Admin"
  2⤵
  PID:4432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Debug"
  2⤵
  PID:5860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Operational"
  2⤵
  PID:5124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
  2⤵
  PID:3932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
  2⤵
  PID:2140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
  2⤵
  PID:1412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RRAS/Debug"
  2⤵
  PID:1504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RRAS/Operational"
  2⤵
  PID:2428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RadioManager/Analytic"
  2⤵
  PID:5984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
  2⤵
  PID:5776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Debug"
  2⤵
  PID:2552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Operational"
  2⤵
  PID:5264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReFS/Operational"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReFsDedupSvc/Operational"
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
  2⤵
  PID:1084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
  2⤵
  PID:5864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
  2⤵
  PID:4480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
  2⤵
  PID:6016
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Regsvr32/Operational"
  2⤵
  PID:2292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
  2⤵
  PID:2812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
  2⤵
  PID:2448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
  2⤵
  PID:2092
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
  2⤵
  PID:1796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
  2⤵
  - Clears Windows event logs
  PID:3068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
  2⤵
  PID:3956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
  2⤵
  PID:3492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
  2⤵
  PID:1824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
  2⤵
  PID:2684
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
  2⤵
  PID:4440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
  2⤵
  PID:3588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
  2⤵
  PID:2244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
  2⤵
  PID:4932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
  2⤵
  PID:3272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RetailDemo/Admin"
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RetailDemo/Operational"
  2⤵
  PID:1480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Graphics/Analytic"
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
  2⤵
  - Clears Windows event logs
  PID:3216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Networking/Tracing"
  2⤵
  - Clears Windows event logs
  PID:4200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
  2⤵
  PID:4596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
  2⤵
  PID:2240
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
  2⤵
  PID:2352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
  2⤵
  PID:1936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
  2⤵
  PID:1268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime/CreateInstance"
  2⤵
  PID:5676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime/Error"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SENSE/Operational"
  2⤵
  PID:728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/Analytic"
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
  2⤵
  PID:2580
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
  2⤵
  PID:1892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/Operational"
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Connectivity"
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Operational"
  2⤵
  PID:4736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Analytic"
  2⤵
  PID:4128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Audit"
  2⤵
  PID:5432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Connectivity"
  2⤵
  PID:1952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Diagnostic"
  2⤵
  PID:2836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Operational"
  2⤵
  PID:2804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Performance"
  2⤵
  PID:4148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Security"
  2⤵
  PID:3940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Admin"
  2⤵
  PID:2772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Informational"
  2⤵
  PID:884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
  2⤵
  PID:2392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
  2⤵
  PID:2436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Schannel-Events/Perf"
  2⤵
  PID:1484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdbus/Analytic"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdbus/Debug"
  2⤵
  PID:1744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdstor/Analytic"
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
  2⤵
  PID:4796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SearchUI/Diagnostic"
  2⤵
  PID:3924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SearchUI/Operational"
  2⤵
  PID:804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecureAssessment/Operational"
  2⤵
  PID:2764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
  2⤵
  PID:1272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
  2⤵
  PID:6076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
  2⤵
  PID:1344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
  2⤵
  PID:5540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-IdentityStore/Performance"
  2⤵
  PID:4012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Isolation-BrokeringFileSystem/Operational"
  2⤵
  PID:1488
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
  2⤵
  PID:3688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/KernelMode"
  2⤵
  PID:3236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/UserMode"
  2⤵
  PID:3784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Netlogon/Operational"
  2⤵
  PID:4720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
  2⤵
  PID:1476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
  2⤵
  PID:5596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX/Analytic"
  2⤵
  PID:5856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
  2⤵
  PID:2412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
  2⤵
  PID:3464
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Vault/Performance"
  2⤵
  PID:5496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
  2⤵
  PID:5816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
  2⤵
  PID:5268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
  2⤵
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SendTo/Diagnostic"
  2⤵
  PID:2600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
  2⤵
  PID:2800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SenseIR/Operational"
  2⤵
  PID:5476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sensors/Debug"
  2⤵
  PID:2076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sensors/Performance"
  2⤵
  - Clears Windows event logs
  PID:1204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
  2⤵
  PID:5068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
  2⤵
  PID:3064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
  2⤵
  PID:2972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
  2⤵
  PID:2280
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
  2⤵
  PID:5080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Servicing/Debug"
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
  2⤵
  PID:2200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupPlatform/Analytic"
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
  2⤵
  PID:1264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
  2⤵
  PID:2440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:2144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
  2⤵
  PID:4604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
  2⤵
  PID:6104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
  2⤵
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"
  2⤵
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"
  2⤵
  PID:5868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/ActionCenter"
  2⤵
  - Clears Windows event logs
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/AppDefaults"
  2⤵
  PID:5824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/Operational"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"
  2⤵
  PID:4428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
  2⤵
  PID:4368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
  2⤵
  PID:1544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
  2⤵
  PID:5100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SleepStudy/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:6060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-Audit/Authentication"
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"
  2⤵
  PID:1252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"
  2⤵
  PID:5156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"
  2⤵
  PID:3124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartScreen/Debug"
  2⤵
  - Clears Windows event logs
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Audit"
  2⤵
  PID:3704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Connectivity"
  2⤵
  PID:5668
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Diagnostic"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Security"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
  2⤵
  PID:1548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Spellchecking-Host/Analytic"
  2⤵
  PID:2192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SruMon/Diagnostic"
  2⤵
  PID:4432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SrumTelemetry"
  2⤵
  PID:5860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Debug"
  2⤵
  PID:5124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Diagnostic"
  2⤵
  PID:3932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Operational"
  2⤵
  PID:2140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Restricted"
  2⤵
  PID:1412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
  2⤵
  PID:1784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Admin"
  2⤵
  PID:1496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Analytic"
  2⤵
  PID:2956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Debug"
  2⤵
  - Clears Windows event logs
  PID:3724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Diagnose"
  2⤵
  PID:5664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Operational"
  2⤵
  PID:3420
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Admin"
  2⤵
  PID:5284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Analytic"
  2⤵
  PID:2540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Debug"
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"
  2⤵
  PID:5136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Operational"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Admin"
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Analytic"
  2⤵
  PID:2588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Debug"
  2⤵
  PID:4608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Diagnose"
  2⤵
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Operational"
  2⤵
  PID:6064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-NvmeDisk/Analytic"
  2⤵
  PID:4560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-NvmeDisk/Diagnose"
  2⤵
  PID:5600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-NvmeDisk/Operational"
  2⤵
  PID:5304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Admin"
  2⤵
  PID:4756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Analytic"
  2⤵
  PID:5744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Debug"
  2⤵
  PID:1592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Diagnose"
  2⤵
  PID:4732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Health"
  2⤵
  PID:3392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Operational"
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Tiering-IoHeat/Heat"
  2⤵
  PID:5116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Tiering/Admin"
  2⤵
  PID:5768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement-PartUtil/Operational"
  2⤵
  PID:5764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement/Debug"
  2⤵
  PID:2604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement/Operational"
  2⤵
  PID:3852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSettings/Diagnostic"
  2⤵
  PID:6032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Api/Operational"
  2⤵
  PID:2732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Diagnostic"
  2⤵
  PID:1132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Operational"
  2⤵
  PID:5756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Performance"
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-ManagementAgent/WHC"
  2⤵
  PID:1268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Parser/Diagnostic"
  2⤵
  PID:5676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Parser/Operational"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic"
  2⤵
  PID:728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Operational"
  2⤵
  PID:1692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageVolume/Diagnostic"
  2⤵
  PID:1984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageVolume/Operational"
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Store/Operational"
  2⤵
  PID:1060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storsvc/Diagnostic"
  2⤵
  PID:3172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"
  2⤵
  PID:5216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sudo/Admin"
  2⤵
  PID:712
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/Main"
  2⤵
  PID:2736
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/PfApLog"
  2⤵
  PID:2784
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"
  2⤵
  PID:1448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"
  2⤵
  PID:1332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-System-Profile-HardwareId/Diagnostic"
  2⤵
  PID:2628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsHandlers/Debug"
  2⤵
  PID:548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Debug"
  2⤵
  PID:3424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Diagnostic"
  2⤵
  PID:1484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Operational"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"
  2⤵
  PID:1744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TCPIP/Operational"
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"
  2⤵
  PID:5748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"
  2⤵
  PID:4796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"
  2⤵
  PID:1600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:5532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TTS/Diagnostic"
  2⤵
  PID:1272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinAPI/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:6076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinUI/Diagnostic"
  2⤵
  PID:5876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinUI/Operational"
  2⤵
  PID:5260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZSync/Analytic"
  2⤵
  PID:3996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZSync/Operational"
  2⤵
  - Clears Windows event logs
  PID:3876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"
  2⤵
  PID:4748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"
  2⤵
  PID:4448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"
  2⤵
  PID:2584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Maintenance"
  2⤵
  PID:3000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"
  2⤵
  PID:2152
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
  2⤵
  PID:1816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TenantRestrictions/Operational"
  2⤵
  PID:1636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
  2⤵
  PID:3284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
  2⤵
  PID:6092
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
  2⤵
  PID:3848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
  2⤵
  PID:1160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
  2⤵
  PID:2796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
  2⤵
  PID:2236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
  2⤵
  PID:2820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
  2⤵
  PID:1396
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
  2⤵
  PID:5476
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
  2⤵
  PID:3904
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
  2⤵
  PID:4888
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Admin"
  2⤵
  PID:5660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Analytic"
  2⤵
  PID:1964
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Debug"
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Operational"
  2⤵
  PID:2388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
  2⤵
  PID:1948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
  2⤵
  PID:1264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
  2⤵
  PID:2440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
  2⤵
  PID:3980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
  2⤵
  PID:240
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
  2⤵
  PID:5384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
  2⤵
  PID:5948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
  2⤵
  PID:5868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Tethering-Manager/Analytic"
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Tethering-Station/Analytic"
  2⤵
  PID:5824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"
  2⤵
  PID:4616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Threat-Intelligence/Analytic"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational"
  2⤵
  PID:2452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Time-Service/Operational"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Admin"
  2⤵
  PID:4368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Operational"
  2⤵
  - Clears Windows event logs
  PID:1544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TunnelDriver"
  2⤵
  PID:4968
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UAC/Operational"
  2⤵
  PID:5100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"
  2⤵
  PID:6060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"
  2⤵
  PID:2028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
  2⤵
  PID:5172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"
  2⤵
  PID:3096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-MAUSBHOST-Analytic"
  2⤵
  PID:5084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-UCMUCSICX/Operational"
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-UCX-Analytic"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
  2⤵
  PID:5388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBHUB3-Analytic"
  2⤵
  PID:1548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Analytic"
  2⤵
  PID:5788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Operational"
  2⤵
  PID:1740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic"
  2⤵
  PID:2172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UniversalTelemetryClient/Operational"
  2⤵
  - Clears Windows event logs
  PID:1212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
  2⤵
  PID:5412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
  2⤵
  PID:5192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel/Diagnostic"
  2⤵
  PID:2252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel/Operational"
  2⤵
  PID:3708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Device Registration/Admin"
  2⤵
  PID:5264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Device Registration/Debug"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"
  2⤵
  PID:1512
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"
  2⤵
  PID:2860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"
  2⤵
  PID:2916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User-Loader/Operational"
  2⤵
  PID:1776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserAccountControl/Diagnostic"
  2⤵
  PID:6056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"
  2⤵
  PID:4840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/ActionCenter"
  2⤵
  PID:5136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceInstall"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
  2⤵
  PID:4108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"
  2⤵
  PID:3068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"
  2⤵
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor/Operational"
  2⤵
  PID:6064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserSettingsBackup-EarlyDownloader/Operational"
  2⤵
  PID:4560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserSettingsBackup-Orchestrator/Operational"
  2⤵
  - Clears Windows event logs
  PID:5600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UxInit/Diagnostic"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"
  2⤵
  PID:6136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"
  2⤵
  PID:916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VHDMP-Analytic"
  2⤵
  PID:5924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VHDMP-Operational"
  2⤵
  PID:5164
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VIRTDISK-Analytic"
  2⤵
  PID:5716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VPN-Client/Operational"
  2⤵
  PID:5800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VPN/Operational"
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"
  2⤵
  PID:1996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Admin"
  2⤵
  PID:1340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Operational"
  2⤵
  PID:1156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"
  2⤵
  PID:1860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Analytic"
  2⤵
  PID:3584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
  2⤵
  PID:5468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WCNWiz/Analytic"
  2⤵
  PID:3868
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WDAG-PolicyEvaluator-CSP/Operational"
  2⤵
  PID:4944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WDAG-PolicyEvaluator-GP/Operational"
  2⤵
  PID:6140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WEPHOSTSVC/Operational"
  2⤵
  PID:5560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WER-Diag/Operational"
  2⤵
  PID:2444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WER-PayloadHealth/Operational"
  2⤵
  PID:4912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WFP/Analytic"
  2⤵
  PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads