b9a916acfa6ecfc3a3f2a3cd8a2ff883b7c3a3b96f0a6b82022570a264830281

Analysis

user interaction
yes
max time kernel
131s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustNextSpoofer.exe
Size 44.9MB
Sample260731-k94chsdm8s
SHA256 b9a916acfa6ecfc3a3f2a3cd8a2ff883b7c3a3b96f0a6b82022570a264830281
MD5 ad1538d8c9b5de993291f6515b8eeffc
SHA1 743ede516d1ecf2a822bfbb80b29fc0ed4c50e51
SHA512 403910f22e205af59652ecedde8e8b4d82d2f6194ecd5f2ab8878fb3b4296e45cfc8bbd062504557251d71621a68f4a2c488dbe1ee7245342d97b8c5a0b8cb3d
SSDEEP 786432:3O1sIEfDZFwsG/+Fdby/ljIkKqASBo6KnE5kZot0ggFesyFKdAgotExTPJRph7oh:3hD1Fwj+Ml9nA9cYoqgQT+L4PJPhUd
TLSH
T164A733FC6355C2EAC07334396411DCB0E4A3B6B87B87DEFF62A249911E472A11E7C958
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2668	wevtutil.exe
6112	wevtutil.exe
3312	wevtutil.exe
4640	wevtutil.exe
3076	wevtutil.exe
828	wevtutil.exe
2972	Process not Found
3580	wevtutil.exe
5340	wevtutil.exe
5140	wevtutil.exe
6036	wevtutil.exe
1976	wevtutil.exe
4640	Process not Found
5108	wevtutil.exe
5364	wevtutil.exe
4112	wevtutil.exe
5832	wevtutil.exe
4588	wevtutil.exe
704	wevtutil.exe
2516	wevtutil.exe
984	wevtutil.exe
4084	Process not Found
4108	wevtutil.exe
2880	wevtutil.exe
3700	Process not Found
5180	Process not Found
2904	wevtutil.exe
2204	wevtutil.exe
5772	wevtutil.exe
5948	wevtutil.exe
956	wevtutil.exe
2320	wevtutil.exe
3164	wevtutil.exe
2012	wevtutil.exe
4636	wevtutil.exe
3780	wevtutil.exe
4576	wevtutil.exe
2092	wevtutil.exe
4524	wevtutil.exe
5296	Process not Found
5264	Process not Found
912	wevtutil.exe
4252	Process not Found
3244	wevtutil.exe
5372	wevtutil.exe
3552	wevtutil.exe
4132	wevtutil.exe
1400	Process not Found
5096	Process not Found
4772	wevtutil.exe
1000	wevtutil.exe
1224	wevtutil.exe
6092	wevtutil.exe
5396	wevtutil.exe
1240	wevtutil.exe
1996	wevtutil.exe
2032	wevtutil.exe
3008	wevtutil.exe
3240	wevtutil.exe
2540	wevtutil.exe
4076	wevtutil.exe
5884	wevtutil.exe
2056	wevtutil.exe
5388	Process not Found

Loads dropped DLL 29 IoCs

pid	Process
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe
5116	RustNextSpoofer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3340	Process not Found

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1960	wevtutil.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3340	Process not Found

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	Process not Found
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	Process not Found

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1540	Process not Found
1920	Process not Found
2136	cmd.exe
4996	cmd.exe
5676	cmd.exe
4872	cmd.exe
3332	cmd.exe
2572	cmd.exe
4740	cmd.exe
4776	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4728	wevtutil.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1396	Process not Found

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
6024	taskkill.exe
5960	taskkill.exe
1336	taskkill.exe
5496	taskkill.exe
1648	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5116	RustNextSpoofer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3340	Process not Found
3340	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5116	RustNextSpoofer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	5496	taskkill.exe
Token: SeDebugPrivilege	1648	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeSecurityPrivilege	2744	wevtutil.exe
Token: SeBackupPrivilege	2744	wevtutil.exe
Token: SeSecurityPrivilege	5516	wevtutil.exe
Token: SeBackupPrivilege	5516	wevtutil.exe
Token: SeSecurityPrivilege	3516	wevtutil.exe
Token: SeBackupPrivilege	3516	wevtutil.exe
Token: SeSecurityPrivilege	5980	wevtutil.exe
Token: SeBackupPrivilege	5980	wevtutil.exe
Token: SeSecurityPrivilege	5768	wevtutil.exe
Token: SeBackupPrivilege	5768	wevtutil.exe
Token: SeSecurityPrivilege	4900	wevtutil.exe
Token: SeBackupPrivilege	4900	wevtutil.exe
Token: SeSecurityPrivilege	912	wevtutil.exe
Token: SeBackupPrivilege	912	wevtutil.exe
Token: SeSecurityPrivilege	704	wevtutil.exe
Token: SeBackupPrivilege	704	wevtutil.exe
Token: SeSecurityPrivilege	3244	wevtutil.exe
Token: SeBackupPrivilege	3244	wevtutil.exe
Token: SeSecurityPrivilege	200	wevtutil.exe
Token: SeBackupPrivilege	200	wevtutil.exe
Token: SeSecurityPrivilege	5032	wevtutil.exe
Token: SeBackupPrivilege	5032	wevtutil.exe
Token: SeSecurityPrivilege	4972	wevtutil.exe
Token: SeBackupPrivilege	4972	wevtutil.exe
Token: SeSecurityPrivilege	2876	wevtutil.exe
Token: SeBackupPrivilege	2876	wevtutil.exe
Token: SeSecurityPrivilege	5984	wevtutil.exe
Token: SeBackupPrivilege	5984	wevtutil.exe
Token: SeSecurityPrivilege	984	wevtutil.exe
Token: SeBackupPrivilege	984	wevtutil.exe
Token: SeSecurityPrivilege	2904	wevtutil.exe
Token: SeBackupPrivilege	2904	wevtutil.exe
Token: SeSecurityPrivilege	4616	wevtutil.exe
Token: SeBackupPrivilege	4616	wevtutil.exe
Token: SeSecurityPrivilege	5404	wevtutil.exe
Token: SeBackupPrivilege	5404	wevtutil.exe
Token: SeSecurityPrivilege	5364	wevtutil.exe
Token: SeBackupPrivilege	5364	wevtutil.exe
Token: SeSecurityPrivilege	3100	wevtutil.exe
Token: SeBackupPrivilege	3100	wevtutil.exe
Token: SeSecurityPrivilege	1400	wevtutil.exe
Token: SeBackupPrivilege	1400	wevtutil.exe
Token: SeSecurityPrivilege	6072	wevtutil.exe
Token: SeBackupPrivilege	6072	wevtutil.exe
Token: SeSecurityPrivilege	4192	wevtutil.exe
Token: SeBackupPrivilege	4192	wevtutil.exe
Token: SeSecurityPrivilege	3580	wevtutil.exe
Token: SeBackupPrivilege	3580	wevtutil.exe
Token: SeSecurityPrivilege	5688	wevtutil.exe
Token: SeBackupPrivilege	5688	wevtutil.exe
Token: SeSecurityPrivilege	3584	wevtutil.exe
Token: SeBackupPrivilege	3584	wevtutil.exe
Token: SeSecurityPrivilege	2204	wevtutil.exe
Token: SeBackupPrivilege	2204	wevtutil.exe
Token: SeSecurityPrivilege	2552	wevtutil.exe
Token: SeBackupPrivilege	2552	wevtutil.exe
Token: SeSecurityPrivilege	1132	wevtutil.exe
Token: SeBackupPrivilege	1132	wevtutil.exe
Token: SeSecurityPrivilege	4264	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 5116	3292	RustNextSpoofer.exe	89
PID 5116 wrote to memory of 2136	5116	RustNextSpoofer.exe	90
PID 2136 wrote to memory of 5960	2136	cmd.exe	92
PID 5116 wrote to memory of 4996	5116	RustNextSpoofer.exe	94
PID 4996 wrote to memory of 1336	4996	cmd.exe	96
PID 5116 wrote to memory of 5676	5116	RustNextSpoofer.exe	97
PID 5676 wrote to memory of 5496	5676	cmd.exe	99
PID 5116 wrote to memory of 4872	5116	RustNextSpoofer.exe	100
PID 4872 wrote to memory of 1648	4872	cmd.exe	102
PID 5116 wrote to memory of 4776	5116	RustNextSpoofer.exe	103
PID 4776 wrote to memory of 6024	4776	cmd.exe	105
PID 5116 wrote to memory of 3332	5116	RustNextSpoofer.exe	106
PID 5116 wrote to memory of 2572	5116	RustNextSpoofer.exe	109
PID 2572 wrote to memory of 4740	2572	cmd.exe	111
PID 4740 wrote to memory of 2744	4740	cmd.exe	112
PID 2572 wrote to memory of 5516	2572	cmd.exe	113
PID 2572 wrote to memory of 3516	2572	cmd.exe	114
PID 2572 wrote to memory of 5980	2572	cmd.exe	115
PID 2572 wrote to memory of 5768	2572	cmd.exe	116
PID 2572 wrote to memory of 4900	2572	cmd.exe	117
PID 2572 wrote to memory of 912	2572	cmd.exe	118
PID 2572 wrote to memory of 704	2572	cmd.exe	119
PID 2572 wrote to memory of 3244	2572	cmd.exe	120
PID 2572 wrote to memory of 200	2572	cmd.exe	121
PID 2572 wrote to memory of 5032	2572	cmd.exe	122
PID 2572 wrote to memory of 4972	2572	cmd.exe	123
PID 2572 wrote to memory of 2876	2572	cmd.exe	124
PID 2572 wrote to memory of 5984	2572	cmd.exe	125
PID 2572 wrote to memory of 984	2572	cmd.exe	126
PID 2572 wrote to memory of 2904	2572	cmd.exe	127
PID 2572 wrote to memory of 4616	2572	cmd.exe	128
PID 2572 wrote to memory of 5404	2572	cmd.exe	129
PID 2572 wrote to memory of 5364	2572	cmd.exe	130
PID 2572 wrote to memory of 3100	2572	cmd.exe	131
PID 2572 wrote to memory of 1400	2572	cmd.exe	132
PID 2572 wrote to memory of 6072	2572	cmd.exe	133
PID 2572 wrote to memory of 4192	2572	cmd.exe	134
PID 2572 wrote to memory of 3580	2572	cmd.exe	135
PID 2572 wrote to memory of 5688	2572	cmd.exe	136
PID 2572 wrote to memory of 3584	2572	cmd.exe	137
PID 2572 wrote to memory of 2204	2572	cmd.exe	138
PID 2572 wrote to memory of 2552	2572	cmd.exe	139
PID 2572 wrote to memory of 1132	2572	cmd.exe	140
PID 2572 wrote to memory of 4264	2572	cmd.exe	141
PID 2572 wrote to memory of 2868	2572	cmd.exe	142
PID 2572 wrote to memory of 2032	2572	cmd.exe	143
PID 2572 wrote to memory of 2092	2572	cmd.exe	144
PID 2572 wrote to memory of 2072	2572	cmd.exe	145
PID 2572 wrote to memory of 476	2572	cmd.exe	146
PID 2572 wrote to memory of 6140	2572	cmd.exe	147
PID 2572 wrote to memory of 2944	2572	cmd.exe	148
PID 2572 wrote to memory of 1136	2572	cmd.exe	149
PID 2572 wrote to memory of 2140	2572	cmd.exe	150
PID 2572 wrote to memory of 1820	2572	cmd.exe	151
PID 2572 wrote to memory of 2812	2572	cmd.exe	152
PID 2572 wrote to memory of 2760	2572	cmd.exe	153
PID 2572 wrote to memory of 6100	2572	cmd.exe	154
PID 2572 wrote to memory of 2520	2572	cmd.exe	155
PID 2572 wrote to memory of 3896	2572	cmd.exe	156
PID 2572 wrote to memory of 2856	2572	cmd.exe	157
PID 2572 wrote to memory of 3788	2572	cmd.exe	158
PID 2572 wrote to memory of 1340	2572	cmd.exe	159
PID 2572 wrote to memory of 3288	2572	cmd.exe	160
PID 2572 wrote to memory of 3344	2572	cmd.exe	161

C:\Users\Admin\AppData\Local\Temp\RustNextSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\RustNextSpoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Users\Admin\AppData\Local\Temp\RustNextSpoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\RustNextSpoofer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM RustClient.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM RustClient.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM EAC_EOS.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EAC_EOS.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM EasyAntiCheat.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM EasyAntiCheat.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM steam.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM steam.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /IM SteamService.exe /T"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM SteamService.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "rmdir /S /Q "C:\Users\Admin\AppData\Local\Temp""
    3⤵
    - Executes a command shell one-liner
    PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "for /f "tokens=*" %1 in ('wevtutil el') do wevtutil cl "%1""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wevtutil el
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\system32\wevtutil.exe
        
        wevtutil el
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "AMSI/Debug"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "AirSpaceChannel"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Analytic"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5980
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Application"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "DirectShowFilterGraph"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4900
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "DirectShowPluginControl"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Els_Hyphenation/Analytic"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:704
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "EndpointMapper"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:3244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "FirstUXPerf-Analytic"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:200
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "ForwardedEvents"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "General Logging"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "HardwareEvents"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2876
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "IHM_DebugChannel"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Intel-iaLPSS-GPIO/Analytic"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Intel-iaLPSS-I2C/Analytic"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:2904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Intel-iaLPSS2-GPIO2/Debug"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Intel-iaLPSS2-GPIO2/Performance"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Intel-iaLPSS2-I2C/Debug"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5364
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Intel-iaLPSS2-I2C/Performance"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3100
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Internet Explorer"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Key Management Service"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:6072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MF_DshowReverseBridge"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MF_MediaFoundationDeviceMFT"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MF_MediaFoundationDeviceProxy"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MF_MediaFoundationFrameServer"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MedaFoundationVideoProc"
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MedaFoundationVideoProcD3D"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2552
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationAsyncWrapper"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationContentProtection"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4264
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationDS"
      4⤵
      PID:2868
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationDeviceProxy"
      4⤵
      PID:2032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationMP4"
      4⤵
      PID:2092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationMediaEngine"
      4⤵
      PID:2072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationPerformance"
      4⤵
      PID:476
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationPerformanceCore"
      4⤵
      PID:6140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationPipeline"
      4⤵
      PID:2944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationPlatform"
      4⤵
      PID:1136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "MediaFoundationSrcPrefetch"
      4⤵
      PID:2140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-AppV-Client-Streamingux/Debug"
      4⤵
      PID:1820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-AppV-Client/Admin"
      4⤵
      PID:2812
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-AppV-Client/Debug"
      4⤵
      PID:2760
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-AppV-Client/Operational"
      4⤵
      PID:6100
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-AppV-Client/Virtual Applications"
      4⤵
      PID:2520
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-AppV-SharedPerformance/Analytic"
      4⤵
      PID:3896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Client-License-Flexible-Platform/Admin"
      4⤵
      PID:2856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Client-License-Flexible-Platform/Debug"
      4⤵
      PID:3788
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Client-License-Flexible-Platform/Diagnostic"
      4⤵
      PID:1340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Client-Licensing-Platform/Admin"
      4⤵
      PID:3288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Client-Licensing-Platform/Debug"
      4⤵
      PID:3344
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Client-Licensing-Platform/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:3008
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-IE/Diagnostic"
      4⤵
      PID:5156
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-IEFRAME/Diagnostic"
      4⤵
      PID:4656
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-JSDumpHeap/Diagnostic"
      4⤵
      PID:3688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-OneCore-Setup/Analytic"
      4⤵
      PID:3616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
      4⤵
      PID:828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
      4⤵
      PID:1976
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"
      4⤵
      PID:1692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-Admin/Debug"
      4⤵
      PID:2884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
      4⤵
      PID:3000
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
      4⤵
      PID:2556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
      4⤵
      PID:5656
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Debug"
      4⤵
      PID:692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Operational"
      4⤵
      Clears Windows event logs
      PID:3240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-IPC/Operational"
      4⤵
      PID:1636
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
      4⤵
      Clears Windows event logs
      PID:5108
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
      4⤵
      PID:1008
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
      4⤵
      PID:3708
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AAD/Analytic"
      4⤵
      PID:2488
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AAD/Operational"
      4⤵
      PID:2164
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ADSI/Debug"
      4⤵
      PID:2916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ASN1/Operational"
      4⤵
      PID:5440
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ATAPort/General"
      4⤵
      PID:1244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"
      4⤵
      PID:2144
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AccelLib-AccelCx/Operational"
      4⤵
      PID:5388
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ActionQueue/Analytic"
      4⤵
      PID:3696
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-All-User-Install-Agent/Admin"
      4⤵
      PID:5096
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppHost/Admin"
      4⤵
      PID:5920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppHost/ApplicationTracing"
      4⤵
      PID:716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppHost/Diagnostic"
      4⤵
      PID:6092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppHost/Internal"
      4⤵
      PID:3856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppID/Operational"
      4⤵
      PID:4464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL"
      4⤵
      PID:4172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppLocker/MSI and Script"
      4⤵
      PID:5944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
      4⤵
      PID:2160
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
      4⤵
      PID:2996
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppLocker/Verbose"
      4⤵
      PID:5028
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppModel-Runtime/Admin"
      4⤵
      PID:1892
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppModel-Runtime/Analytic"
      4⤵
      PID:2288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppModel-Runtime/Debug"
      4⤵
      PID:1844
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
      4⤵
      PID:5208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppModel-State/Debug"
      4⤵
      PID:2188
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppModel-State/Diagnostic"
      4⤵
      PID:2540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppReadiness/Admin"
      4⤵
      PID:2972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppReadiness/Debug"
      4⤵
      PID:2356
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppReadiness/Operational"
      4⤵
      PID:2908
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppSruProv"
      4⤵
      PID:6004
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppXDeployment/Diagnostic"
      4⤵
      PID:896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppXDeployment/Operational"
      4⤵
      PID:1260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Debug"
      4⤵
      PID:1700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
      4⤵
      PID:4724
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Operational"
      4⤵
      PID:3544
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
      4⤵
      PID:6024
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
      4⤵
      PID:956
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Operational"
      4⤵
      PID:1840
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application Server-Applications/Admin"
      4⤵
      PID:5960
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application Server-Applications/Analytic"
      4⤵
      PID:4904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application Server-Applications/Debug"
      4⤵
      PID:2284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application Server-Applications/Operational"
      4⤵
      PID:5860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
      4⤵
      PID:4984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
      4⤵
      PID:5832
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
      4⤵
      PID:4916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
      4⤵
      PID:3508
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
      4⤵
      PID:4472
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"
      4⤵
      PID:5400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
      4⤵
      PID:4208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
      4⤵
      PID:772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppxPackaging/Debug"
      4⤵
      PID:5980
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppxPackaging/Operational"
      4⤵
      PID:5624
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AppxPackaging/Performance"
      4⤵
      PID:2516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AssignedAccess/Admin"
      4⤵
      PID:2312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AssignedAccess/Operational"
      4⤵
      PID:2752
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Admin"
      4⤵
      PID:5888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Operational"
      4⤵
      PID:2084
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AsynchronousCausality/Causality"
      4⤵
      PID:1904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"
      4⤵
      PID:4072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audio/GlitchDetection"
      4⤵
      PID:4972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audio/Informational"
      4⤵
      PID:4864
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audio/Operational"
      4⤵
      PID:3208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audio/Performance"
      4⤵
      PID:4392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audio/PlaybackManager"
      4⤵
      PID:5936
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Audit/Analytic"
      4⤵
      Clears Windows event logs
      PID:5372
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Authentication User Interface/Operational"
      4⤵
      PID:5408
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
      4⤵
      PID:5364
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
      4⤵
      PID:1596
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
      4⤵
      PID:3860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
      4⤵
      PID:1396
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-AxInstallService/Log"
      4⤵
      PID:4588
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BTH-BTHPORT/HCI"
      4⤵
      Clears Windows event logs
      PID:3580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
      4⤵
      PID:5688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
      4⤵
      PID:3584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Performance"
      4⤵
      PID:3312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
      4⤵
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
      4⤵
      PID:1132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
      4⤵
      PID:4264
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Backup"
      4⤵
      PID:1096
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
      4⤵
      PID:2652
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
      4⤵
      PID:4148
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Battery/Diagnostic"
      4⤵
      PID:1476
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Biometrics/Analytic"
      4⤵
      PID:1924
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Biometrics/Operational"
      4⤵
      PID:4964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
      4⤵
      PID:4592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
      4⤵
      PID:1136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
      4⤵
      PID:2140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Management"
      4⤵
      PID:3376
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Operational"
      4⤵
      PID:3308
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BitLocker/Tracing"
      4⤵
      PID:3188
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Bits-Client/Analytic"
      4⤵
      PID:4132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Bits-Client/Operational"
      4⤵
      PID:1316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
      4⤵
      PID:1580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
      4⤵
      PID:3464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
      4⤵
      PID:5340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Bluetooth-Policy/Operational"
      4⤵
      PID:5952
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BranchCache/Operational"
      4⤵
      PID:1172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
      4⤵
      PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
      4⤵
      PID:6036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
      4⤵
      PID:1968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"
      4⤵
      PID:3556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"
      4⤵
      PID:4092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
      4⤵
      PID:5848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CAPI2/Operational"
      4⤵
      Clears Windows event logs
      PID:4112
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CDROM/Operational"
      4⤵
      PID:4388
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/Analytic"
      4⤵
      PID:1728
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/ApartmentInitialize"
      4⤵
      PID:5972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/ApartmentUninitialize"
      4⤵
      Clears Windows event logs
      PID:2320
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/Call"
      4⤵
      PID:2300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/CreateInstance"
      4⤵
      PID:4640
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/ExtensionCatalog"
      4⤵
      PID:4484
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/FreeUnusedLibrary"
      4⤵
      PID:1636
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COM/RundownInstrumentation"
      4⤵
      PID:5108
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COMRuntime/Activations"
      4⤵
      PID:1008
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COMRuntime/MessageProcessing"
      4⤵
      PID:3708
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-COMRuntime/Tracing"
      4⤵
      PID:2488
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Calculator/Debug"
      4⤵
      PID:2164
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Calculator/Diagnostic"
      4⤵
      PID:2916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CertPoleEng/Operational"
      4⤵
      PID:5440
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
      4⤵
      PID:1244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
      4⤵
      PID:2144
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
      4⤵
      PID:5388
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Cleanmgr/Diagnostic"
      4⤵
      PID:3696
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
      4⤵
      PID:5096
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CloudFiles-Filter/Debug"
      4⤵
      PID:5920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CloudFiles-Filter/Operational"
      4⤵
      PID:716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CloudRestoreLauncher/Operational"
      4⤵
      PID:6092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CloudStore/Debug"
      4⤵
      PID:3856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CloudStore/Initialization"
      4⤵
      PID:4464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CloudStore/Operational"
      4⤵
      PID:4172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CmiSetup/Analytic"
      4⤵
      PID:2852
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"
      4⤵
      PID:4608
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"
      4⤵
      PID:4632
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ComDlg32/Analytic"
      4⤵
      PID:824
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ComDlg32/Debug"
      4⤵
      PID:5012
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Compat-Appraiser/Analytic"
      4⤵
      PID:5620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Compat-Appraiser/Operational"
      4⤵
      PID:1640
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Containers-BindFlt/Debug"
      4⤵
      PID:1312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Containers-BindFlt/Operational"
      4⤵
      PID:796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Containers-Wcifs/Debug"
      4⤵
      PID:5496
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Containers-Wcifs/Operational"
      4⤵
      PID:5460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreApplication/Diagnostic"
      4⤵
      PID:1740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreApplication/Operational"
      4⤵
      PID:2988
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreApplication/Tracing"
      4⤵
      PID:3400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
      4⤵
      PID:1648
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
      4⤵
      PID:4488
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreWindow/Analytic"
      4⤵
      PID:3076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CoreWindow/Debug"
      4⤵
      PID:5836
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
      4⤵
      PID:5280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
      4⤵
      Clears Windows event logs
      PID:3164
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crashdump/Analytic"
      4⤵
      PID:3536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crashdump/Operational"
      4⤵
      PID:2788
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-CredUI/Diagnostic"
      4⤵
      PID:2992
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
      4⤵
      PID:5104
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-CNG/Analytic"
      4⤵
      PID:4792
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
      4⤵
      PID:5860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Debug"
      4⤵
      PID:4984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Operational"
      4⤵
      Clears Windows event logs
      PID:5832
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
      4⤵
      PID:4916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-NCrypt/CertInUse"
      4⤵
      PID:3508
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-NCrypt/KeyMgmt"
      4⤵
      PID:2440
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-NCrypt/Operational"
      4⤵
      PID:4584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"
      4⤵
      PID:5024
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
      4⤵
      PID:5612
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"
      4⤵
      PID:3516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"
      4⤵
      PID:5516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DAL-Provider/Analytic"
      4⤵
      PID:5864
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DAL-Provider/Operational"
      4⤵
      PID:4900
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DCLocator/Debug"
      4⤵
      Clears Windows event logs
      PID:912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DDisplay/Analytic"
      4⤵
      PID:704
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DDisplay/Logging"
      4⤵
      PID:3244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DLNA-Namespace/Analytic"
      4⤵
      PID:5948
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
      4⤵
      PID:4624
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DSC/Admin"
      4⤵
      PID:1196
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DSC/Analytic"
      4⤵
      PID:2404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DSC/Debug"
      4⤵
      PID:4540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DSC/Operational"
      4⤵
      PID:3540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DUI/Diagnostic"
      4⤵
      PID:4256
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DUSER/Diagnostic"
      4⤵
      PID:2904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DXGI/Analytic"
      4⤵
      PID:556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DXGI/Logging"
      4⤵
      PID:2536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DXP/Analytic"
      4⤵
      Clears Windows event logs
      PID:2668
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Data-Pdf/Debug"
      4⤵
      PID:4988
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DataIntegrityScan/Admin"
      4⤵
      PID:5192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
      4⤵
      PID:4536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
      4⤵
      Clears Windows event logs
      PID:6112
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"
      4⤵
      PID:5820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"
      4⤵
      PID:5732
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Deduplication/Diagnostic"
      4⤵
      PID:3420
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Deduplication/Operational"
      4⤵
      PID:2888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Deduplication/Performance"
      4⤵
      PID:1592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Deduplication/Scrubbing"
      4⤵
      PID:3312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Defrag-Core/Debug"
      4⤵
      PID:3764
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Deplorch/Analytic"
      4⤵
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
      4⤵
      PID:1132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceAssociationService/Performance"
      4⤵
      PID:2448
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceConfidence/Analytic"
      4⤵
      PID:5664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceGuard/Operational"
      4⤵
      PID:2680
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceGuard/Verbose"
      4⤵
      PID:5140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
      4⤵
      PID:3928
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot"
      4⤵
      PID:5924
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
      4⤵
      PID:2944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
      4⤵
      PID:4268
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceSetupManager/Admin"
      4⤵
      PID:2568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceSetupManager/Analytic"
      4⤵
      PID:1468
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceSetupManager/Debug"
      4⤵
      PID:2688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceSetupManager/Operational"
      4⤵
      PID:2564
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceSync/Analytic"
      4⤵
      PID:3276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceSync/Operational"
      4⤵
      PID:4132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
      4⤵
      PID:1316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceUx/Informational"
      4⤵
      PID:1580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DeviceUx/Performance"
      4⤵
      PID:3464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Devices-Background/Operational"
      4⤵
      PID:2460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Devices-Query/Performance"
      4⤵
      Clears Windows event logs
      PID:5340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"
      4⤵
      PID:1172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"
      4⤵
      PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"
      4⤵
      PID:6036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"
      4⤵
      PID:1968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DiagCpl/Debug"
      4⤵
      PID:3556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
      4⤵
      PID:4092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
      4⤵
      PID:828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"
      4⤵
      PID:1412
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"
      4⤵
      PID:3572
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
      4⤵
      PID:2884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
      4⤵
      PID:856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"
      4⤵
      PID:2336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"
      4⤵
      PID:3720
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"
      4⤵
      PID:4292
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"
      4⤵
      PID:4600
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
      4⤵
      PID:5772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
      4⤵
      PID:1960
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
      4⤵
      PID:1248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
      4⤵
      PID:2428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
      4⤵
      PID:2220
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
      4⤵
      PID:5016
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
      4⤵
      PID:3780
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
      4⤵
      PID:5560
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"
      4⤵
      PID:2596
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"
      4⤵
      PID:3568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"
      4⤵
      PID:1736
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
      4⤵
      PID:4932
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
      4⤵
      PID:1964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
      4⤵
      PID:1000
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"
      4⤵
      PID:3284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D10/Analytic"
      4⤵
      PID:4868
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"
      4⤵
      PID:4576
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D11/Analytic"
      4⤵
      PID:928
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D11/Logging"
      4⤵
      PID:3452
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"
      4⤵
      PID:1992
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D12/Analytic"
      4⤵
      PID:1940
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D12/Logging"
      4⤵
      PID:5180
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D12/PerfTiming"
      4⤵
      PID:1300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3D9/Analytic"
      4⤵
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Direct3DShaderCache/Default"
      4⤵
      PID:2288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DirectComposition/Diagnostic"
      4⤵
      PID:4348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DirectManipulation/Diagnostic"
      4⤵
      PID:3804
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
      4⤵
      PID:1312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DirectSound/Debug"
      4⤵
      PID:796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Disk/Operational"
      4⤵
      PID:5496
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"
      4⤵
      PID:5460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
      4⤵
      PID:1740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
      4⤵
      PID:2988
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dism-Api/Analytic"
      4⤵
      PID:5540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
      4⤵
      PID:896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
      4⤵
      PID:1260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dism-Cli/Analytic"
      4⤵
      PID:1700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"
      4⤵
      PID:5176
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"
      4⤵
      PID:3316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
      4⤵
      PID:3356
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Documents/Performance"
      4⤵
      PID:5912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
      4⤵
      PID:1840
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DriverProxy/Operational"
      4⤵
      PID:4080
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DriverProxy/Performance"
      4⤵
      PID:4904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dwm-API/Diagnostic"
      4⤵
      PID:2284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dwm-Compositor/Diagnostic"
      4⤵
      PID:4920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dwm-Core/Diagnostic"
      4⤵
      PID:1056
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
      4⤵
      PID:620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
      4⤵
      PID:4620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
      4⤵
      PID:5076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl-Admin"
      4⤵
      PID:4524
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl-Operational"
      4⤵
      PID:2744
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl-SysMm/Debug"
      4⤵
      PID:5400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl-SysMm/Performance"
      4⤵
      PID:4208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl/Contention"
      4⤵
      PID:772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"
      4⤵
      PID:2576
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl/Performance"
      4⤵
      PID:5624
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxgKrnl/Power"
      4⤵
      PID:2516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
      4⤵
      PID:4796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EDP-Application-Learning/Admin"
      4⤵
      PID:1996
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
      4⤵
      Clears Windows event logs
      PID:4772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
      4⤵
      PID:4304
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EFS/Debug"
      4⤵
      PID:248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EFS/Operational"
      4⤵
      PID:4072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ESE/IODiagnose"
      4⤵
      PID:2876
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ESE/Operational"
      4⤵
      PID:5984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapHost/Analytic"
      4⤵
      PID:984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapHost/Debug"
      4⤵
      PID:4392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapHost/Operational"
      4⤵
      PID:4616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapMethods-RasChap/Operational"
      4⤵
      PID:3036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapMethods-RasTls/Operational"
      4⤵
      PID:5404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapMethods-Sim/Operational"
      4⤵
      PID:3100
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EapMethods-Ttls/Operational"
      4⤵
      PID:3360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
      4⤵
      PID:6072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
      4⤵
      PID:4192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
      4⤵
      Clears Windows event logs
      PID:4588
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorClass/Operational"
      4⤵
      PID:1920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
      4⤵
      PID:4896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EventCollector/Debug"
      4⤵
      PID:5692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EventCollector/Operational"
      4⤵
      PID:1360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
      4⤵
      PID:2552
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EventLog/Analytic"
      4⤵
      PID:4332
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-EventLog/Debug"
      4⤵
      PID:5652
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FMS/Analytic"
      4⤵
      PID:3764
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FMS/Debug"
      4⤵
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FMS/Operational"
      4⤵
      PID:1132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
      4⤵
      PID:2448
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Operational"
      4⤵
      PID:5664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
      4⤵
      PID:2680
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FeatureConfiguration/Analytic"
      4⤵
      Clears Windows event logs
      PID:5140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FeatureConfiguration/Operational"
      4⤵
      PID:3928
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
      4⤵
      PID:5924
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
      4⤵
      PID:2944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Debug"
      4⤵
      PID:4268
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
      4⤵
      PID:2568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
      4⤵
      PID:1468
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Core/Analytic"
      4⤵
      PID:2688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Core/Debug"
      4⤵
      PID:2564
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Core/WHC"
      4⤵
      PID:3276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Engine/Analytic"
      4⤵
      PID:4132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
      4⤵
      PID:1316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Engine/Debug"
      4⤵
      PID:1580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
      4⤵
      PID:3464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Debug"
      4⤵
      PID:2460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Service/Analytic"
      4⤵
      PID:5340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-Service/Debug"
      4⤵
      PID:1172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
      4⤵
      PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
      4⤵
      PID:6036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"
      4⤵
      PID:1968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
      4⤵
      PID:3556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Folder Redirection/Operational"
      4⤵
      PID:4092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Forwarding/Debug"
      4⤵
      PID:828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Forwarding/Operational"
      4⤵
      PID:1412
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
      4⤵
      PID:3572
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-GenericRoaming/Admin"
      4⤵
      PID:2884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-GroupPolicy/Operational"
      4⤵
      PID:856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HAL/Debug"
      4⤵
      PID:2336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HealthCenter/Debug"
      4⤵
      PID:3720
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HealthCenter/Performance"
      4⤵
      PID:4292
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"
      4⤵
      PID:4600
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HelloForBusiness/Debug"
      4⤵
      Clears Windows event logs
      PID:5772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HelloForBusiness/Operational"
      4⤵
      PID:1960
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Help/Operational"
      4⤵
      PID:1248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
      4⤵
      PID:2428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
      4⤵
      PID:2220
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HotspotAuth/Analytic"
      4⤵
      PID:5016
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HotspotAuth/Operational"
      4⤵
      PID:3780
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HttpService/Log"
      4⤵
      PID:5560
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-HttpService/Trace"
      4⤵
      PID:2596
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
      4⤵
      PID:3568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
      4⤵
      PID:1736
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
      4⤵
      PID:4932
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
      4⤵
      PID:1964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
      4⤵
      Clears Windows event logs
      PID:1000
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
      4⤵
      PID:3284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
      4⤵
      PID:4868
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
      4⤵
      PID:4576
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-KMCL-Child/Analytic"
      4⤵
      PID:928
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
      4⤵
      PID:3452
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-VID-Admin"
      4⤵
      PID:1992
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Hyper-V-VID-Analytic"
      4⤵
      PID:1940
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IE-SmartScreen"
      4⤵
      PID:5180
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IKE/Operational"
      4⤵
      PID:1300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IKEDBG/Debug"
      4⤵
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-Broker/Analytic"
      4⤵
      PID:2288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-CandidateUI/Analytic"
      4⤵
      PID:4348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
      4⤵
      PID:3804
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
      4⤵
      PID:1312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-JPAPI/Analytic"
      4⤵
      PID:796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-JPLMP/Analytic"
      4⤵
      PID:5496
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-JPPRED/Analytic"
      4⤵
      PID:1768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-JPSetting/Analytic"
      4⤵
      PID:6004
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-JPTIP/Analytic"
      4⤵
      PID:3400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-KRAPI/Analytic"
      4⤵
      PID:1648
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-KRTIP/Analytic"
      4⤵
      PID:5896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
      4⤵
      Clears Windows event logs
      PID:3076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-TCCORE/Analytic"
      4⤵
      PID:5836
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-TCTIP/Analytic"
      4⤵
      PID:5280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IME-TIP/Analytic"
      4⤵
      PID:432
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IPNAT/Diagnostic"
      4⤵
      PID:4280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
      4⤵
      PID:2788
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IPxlatCfg/Debug"
      4⤵
      PID:2992
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IPxlatCfg/Operational"
      4⤵
      PID:5160
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IdCtrls/Analytic"
      4⤵
      PID:4792
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IdCtrls/Operational"
      4⤵
      PID:5860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
      4⤵
      PID:1420
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
      4⤵
      PID:3756
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-InputSwitch/Diagnostic"
      4⤵
      PID:4916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
      4⤵
      PID:3508
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"
      4⤵
      PID:5872
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"
      4⤵
      PID:1472
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"
      4⤵
      PID:5628
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-KdsSvc/Operational"
      4⤵
      PID:5612
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational"
      4⤵
      PID:772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance"
      4⤵
      PID:5516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kerberos/Operational"
      4⤵
      PID:5864
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
      4⤵
      PID:4900
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-AppCompat/General"
      4⤵
      PID:912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-AppCompat/Performance"
      4⤵
      PID:5888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
      4⤵
      PID:3244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
      4⤵
      PID:2084
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
      4⤵
      PID:5948
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"
      4⤵
      PID:3552
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Boot/Operational"
      4⤵
      PID:2404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
      4⤵
      PID:4864
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-CPU-Partition/Analytic"
      4⤵
      PID:4876
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-CPU-Starvation/Operational"
      4⤵
      PID:4376
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Cache/Operational"
      4⤵
      PID:4616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"
      4⤵
      PID:3036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Dump/Operational"
      4⤵
      PID:5404
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"
      4⤵
      PID:3100
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
      4⤵
      PID:3360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-File/Analytic"
      4⤵
      PID:6072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-IO/Operational"
      4⤵
      PID:4192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
      4⤵
      PID:5820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
      4⤵
      PID:1920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
      4⤵
      PID:1460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Operational"
      4⤵
      PID:4896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"
      4⤵
      PID:1360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"
      4⤵
      PID:2552
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PRM/Operational"
      4⤵
      PID:4332
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
      4⤵
      PID:5652
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
      4⤵
      PID:3764
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
      4⤵
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"
      4⤵
      PID:1132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
      4⤵
      PID:2448
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
      4⤵
      PID:5664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Management"
      4⤵
      PID:2680
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
      4⤵
      PID:5140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
      4⤵
      PID:3928
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"
      4⤵
      PID:5924
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
      4⤵
      PID:2944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
      4⤵
      PID:4268
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
      4⤵
      PID:2568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"
      4⤵
      PID:1468
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
      4⤵
      PID:2688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"
      4⤵
      PID:2564
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-Registry/Performance"
      4⤵
      PID:3276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
      4⤵
      PID:4132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
      4⤵
      PID:1316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
      4⤵
      PID:1580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
      4⤵
      PID:3464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
      4⤵
      PID:2460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"
      4⤵
      PID:5340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"
      4⤵
      PID:1172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"
      4⤵
      PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"
      4⤵
      Clears Windows event logs
      PID:6036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"
      4⤵
      PID:1968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Kernel-XDV/Analytic"
      4⤵
      PID:3556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-KeyboardFilter/Admin"
      4⤵
      PID:4092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-KeyboardFilter/Operational"
      4⤵
      PID:828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-KeyboardFilter/Performance"
      4⤵
      PID:1412
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Known Folders API Service"
      4⤵
      PID:3572
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-L2NA/Diagnostic"
      4⤵
      PID:2884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LAPS/Operational"
      4⤵
      PID:856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LDAP-Client/Debug"
      4⤵
      PID:2336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LSA/Diagnostic"
      4⤵
      PID:3720
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LSA/Operational"
      4⤵
      PID:4292
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LSA/Performance"
      4⤵
      PID:4600
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
      4⤵
      PID:5772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"
      4⤵
      PID:1960
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"
      4⤵
      PID:1248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"
      4⤵
      PID:2428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LimitsManagement/Diagnostic"
      4⤵
      PID:2220
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
      4⤵
      PID:1888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
      4⤵
      PID:3780
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LiveId/Analytic"
      4⤵
      PID:5560
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LiveId/Operational"
      4⤵
      PID:2596
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-LocationServiceProvider/Debug"
      4⤵
      PID:3568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
      4⤵
      PID:1736
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
      4⤵
      PID:4932
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"
      4⤵
      PID:5348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"
      4⤵
      PID:1964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
      4⤵
      PID:3284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MSPaint/Admin"
      4⤵
      PID:4868
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MSPaint/Debug"
      4⤵
      Clears Windows event logs
      PID:4576
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MSPaint/Diagnostic"
      4⤵
      PID:928
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MUI/Admin"
      4⤵
      PID:3452
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MUI/Analytic"
      4⤵
      PID:1992
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MUI/Debug"
      4⤵
      PID:1940
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MUI/Operational"
      4⤵
      PID:5180
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Media-Streaming/DMC"
      4⤵
      PID:1300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Media-Streaming/DMR"
      4⤵
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Media-Streaming/MDE"
      4⤵
      PID:2288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
      4⤵
      PID:4348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
      4⤵
      PID:3804
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
      4⤵
      PID:1312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
      4⤵
      PID:796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
      4⤵
      PID:4216
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
      4⤵
      PID:2908
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
      4⤵
      Clears Windows event logs
      PID:1224
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Minstore/Analytic"
      4⤵
      PID:2724
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Minstore/Debug"
      4⤵
      PID:4820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
      4⤵
      PID:1260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
      4⤵
      PID:4188
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
      4⤵
      PID:1948
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MobilityCenter/Performance"
      4⤵
      PID:956
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
      4⤵
      PID:3536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
      4⤵
      PID:1620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
      4⤵
      PID:5168
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics"
      4⤵
      PID:5104
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
      4⤵
      PID:1120
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MosHost/Operational"
      4⤵
      PID:1236
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-MosHost/Performance"
      4⤵
      PID:4984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Mprddm/Operational"
      4⤵
      PID:5868
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NCSI/Analytic"
      4⤵
      PID:3820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NCSI/Operational"
      4⤵
      PID:2008
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
      4⤵
      PID:2440
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
      4⤵
      PID:1828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NDIS/Diagnostic"
      4⤵
      PID:5024
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NDIS/Operational"
      4⤵
      PID:3340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NTLM/Operational"
      4⤵
      PID:5768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"
      4⤵
      PID:2420
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Narrator/Diagnostic"
      4⤵
      PID:3088
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Ncasvc/Operational"
      4⤵
      PID:4672
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
      4⤵
      PID:2312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NcdAutoSetup/Operational"
      4⤵
      Clears Windows event logs
      PID:704
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NdisImPlatform/Operational"
      4⤵
      PID:200
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Ndu/Diagnostic"
      4⤵
      PID:1904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetShell/Performance"
      4⤵
      PID:4624
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Network-Connection-Broker"
      4⤵
      PID:1196
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Network-ExecutionContext/Operational"
      4⤵
      PID:4972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Network-Setup/Diagnostic"
      4⤵
      PID:4716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
      4⤵
      PID:3208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkBridge/Diagnostic"
      4⤵
      PID:5368
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"
      4⤵
      PID:4392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkProfile/Operational"
      4⤵
      PID:5372
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkProvider/Operational"
      4⤵
      PID:3048
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkProvisioning/Analytic"
      4⤵
      Clears Windows event logs
      PID:5364
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkProvisioning/Operational"
      4⤵
      PID:1400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NetworkSecurity/Debug"
      4⤵
      PID:3860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
      4⤵
      PID:4664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
      4⤵
      System Time Discovery
      PID:4728
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"
      4⤵
      PID:4588
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-NlaSvc/Operational"
      4⤵
      PID:3948
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Ntfs/Operational"
      4⤵
      PID:5692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Ntfs/Performance"
      4⤵
      PID:2888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Ntfs/WHC"
      4⤵
      PID:5508
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OLE/Clipboard-Performance"
      4⤵
      PID:2816
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OLEACC/Debug"
      4⤵
      PID:4784
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"
      4⤵
      PID:1848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
      4⤵
      PID:2608
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
      4⤵
      PID:2032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:2092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
      4⤵
      PID:2072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
      4⤵
      PID:4148
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"
      4⤵
      PID:244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OfflineFiles/Debug"
      4⤵
      PID:6140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OfflineFiles/Operational"
      4⤵
      PID:988
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"
      4⤵
      PID:4592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OneBackup/Debug"
      4⤵
      PID:5936
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OneX/Diagnostic"
      4⤵
      PID:2944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OneX/Operational"
      4⤵
      PID:4268
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OobeLdr/Analytic"
      4⤵
      PID:2568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-OtpCredentialProvider/Operational"
      4⤵
      PID:1468
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PCI/Diagnostic"
      4⤵
      PID:2688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PCI/Operational"
      4⤵
      PID:2564
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ParentalControls/Operational"
      4⤵
      PID:3276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Partition/Analytic"
      4⤵
      PID:4132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Partition/Debug"
      4⤵
      PID:1316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Partition/Diagnostic"
      4⤵
      PID:1580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PerceptionRuntime/Operational"
      4⤵
      PID:3464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
      4⤵
      PID:2460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Perflib/Operational"
      4⤵
      PID:5340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
      4⤵
      PID:1172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
      4⤵
      PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
      4⤵
      PID:6036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
      4⤵
      PID:1968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
      4⤵
      PID:3556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
      4⤵
      PID:4092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
      4⤵
      Clears Windows event logs
      PID:828
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
      4⤵
      PID:1412
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
      4⤵
      PID:3572
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
      4⤵
      PID:2884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PhotoAcq/Analytic"
      4⤵
      PID:856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PlayToManager/Analytic"
      4⤵
      PID:2336
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Policy/Analytic"
      4⤵
      PID:3720
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Policy/Operational"
      4⤵
      PID:4292
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
      4⤵
      PID:4600
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
      4⤵
      PID:5772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"
      4⤵
      Power Settings
      PID:1960
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"
      4⤵
      PID:1248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
      4⤵
      PID:2428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
      4⤵
      PID:2220
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
      4⤵
      PID:1888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
      4⤵
      PID:3780
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell/Admin"
      4⤵
      PID:5560
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell/Analytic"
      4⤵
      PID:4412
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell/Debug"
      4⤵
      PID:3912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PowerShell/Operational"
      4⤵
      PID:6136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PrintBRM/Admin"
      4⤵
      PID:1000
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PrintService-USBMon/Debug"
      4⤵
      Clears Windows event logs
      PID:6092
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PrintService/Admin"
      4⤵
      PID:3856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PrintService/Debug"
      4⤵
      PID:4464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PrintService/Operational"
      4⤵
      Clears Windows event logs
      PID:5396
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode/Operational"
      4⤵
      PID:5944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Privacy-Auditing/Operational"
      4⤵
      PID:2160
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
      4⤵
      PID:2996
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
      4⤵
      PID:1204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
      4⤵
      PID:1892
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
      4⤵
      PID:5620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
      4⤵
      PID:1844
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
      4⤵
      PID:5660
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
      4⤵
      PID:3136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Proximity-Common/Diagnostic"
      4⤵
      PID:2540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Proximity-Common/Informational"
      4⤵
      PID:4668
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Proximity-Common/Performance"
      4⤵
      PID:5460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PushNotification-Developer/Debug"
      4⤵
      PID:1740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PushNotification-InProc/Debug"
      4⤵
      PID:1768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PushNotification-Platform/Admin"
      4⤵
      PID:1900
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PushNotification-Platform/Debug"
      4⤵
      PID:3400
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-PushNotification-Platform/Operational"
      4⤵
      PID:896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
      4⤵
      PID:3544
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"
      4⤵
      PID:1700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"
      4⤵
      PID:5836
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RPC/Debug"
      4⤵
      PID:2224
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RPC/EEInfo"
      4⤵
      PID:3356
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RRAS/Debug"
      4⤵
      Clears Windows event logs
      PID:2012
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RRAS/Operational"
      4⤵
      PID:1840
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RadioManager/Analytic"
      4⤵
      PID:3952
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
      4⤵
      PID:3332
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RasAgileVpn/Debug"
      4⤵
      Clears Windows event logs
      PID:4108
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RasAgileVpn/Operational"
      4⤵
      PID:5860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ReFS/Operational"
      4⤵
      PID:1420
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ReFsDedupSvc/Operational"
      4⤵
      PID:3756
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"
      4⤵
      PID:4916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ReadyBoost/Operational"
      4⤵
      PID:3508
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
      4⤵
      PID:5872
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"
      4⤵
      PID:1472
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Regsvr32/Operational"
      4⤵
      PID:5628
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
      4⤵
      PID:3516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
      4⤵
      PID:772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"
      4⤵
      PID:5516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"
      4⤵
      PID:5864
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"
      4⤵
      Clears Windows event logs
      PID:2516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
      4⤵
      PID:912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
      4⤵
      PID:5888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
      4⤵
      PID:3244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
      4⤵
      PID:2084
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:5948
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
      4⤵
      Clears Windows event logs
      PID:3552
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
      4⤵
      PID:2876
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
      4⤵
      PID:4864
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
      4⤵
      PID:4876
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ResourcePublication/Tracing"
      4⤵
      PID:4376
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RestartManager/Operational"
      4⤵
      PID:3740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RetailDemo/Admin"
      4⤵
      PID:2536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-RetailDemo/Operational"
      4⤵
      PID:2668
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Graphics/Analytic"
      4⤵
      PID:1596
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
      4⤵
      PID:2316
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Networking/Tracing"
      4⤵
      PID:1396
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
      4⤵
      PID:4700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
      4⤵
      PID:3580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
      4⤵
      PID:5688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
      4⤵
      PID:3700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
      4⤵
      PID:3584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
      4⤵
      PID:1592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime/CreateInstance"
      4⤵
      Clears Windows event logs
      PID:3312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Runtime/Error"
      4⤵
      PID:860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SENSE/Operational"
      4⤵
      PID:5284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBClient/Analytic"
      4⤵
      PID:1108
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
      4⤵
      PID:4264
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
      4⤵
      PID:1096
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBClient/Operational"
      4⤵
      PID:2652
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBDirect/Connectivity"
      4⤵
      PID:4968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBDirect/Operational"
      4⤵
      PID:244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Analytic"
      4⤵
      Clears Windows event logs
      PID:4636
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Audit"
      4⤵
      PID:1832
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Connectivity"
      4⤵
      PID:4288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Diagnostic"
      4⤵
      PID:1136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Operational"
      4⤵
      PID:1820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Performance"
      4⤵
      PID:2812
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBServer/Security"
      4⤵
      PID:1076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBWitnessClient/Admin"
      4⤵
      PID:2760
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SMBWitnessClient/Informational"
      4⤵
      PID:3792
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
      4⤵
      PID:1480
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
      4⤵
      PID:2968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Schannel-Events/Perf"
      4⤵
      PID:5852
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sdbus/Analytic"
      4⤵
      PID:5952
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sdbus/Debug"
      4⤵
      Clears Windows event logs
      PID:2880
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sdstor/Analytic"
      4⤵
      PID:3344
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Search-Core/Diagnostic"
      4⤵
      PID:2756
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
      4⤵
      PID:5156
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SearchUI/Diagnostic"
      4⤵
      PID:6044
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SearchUI/Operational"
      4⤵
      PID:3688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SecureAssessment/Operational"
      4⤵
      PID:3612
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
      4⤵
      PID:4112
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
      4⤵
      PID:1976
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
      4⤵
      PID:4708
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
      4⤵
      PID:5428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
      4⤵
      PID:5584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-IdentityStore/Performance"
      4⤵
      PID:3392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Isolation-BrokeringFileSystem/Operational"
      4⤵
      PID:2300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
      4⤵
      PID:4640
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Mitigations/KernelMode"
      4⤵
      PID:4484
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Mitigations/UserMode"
      4⤵
      PID:3720
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Netlogon/Operational"
      4⤵
      PID:4292
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
      4⤵
      PID:3708
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
      4⤵
      PID:4600
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
      4⤵
      PID:1568
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-SPP-UX/Analytic"
      4⤵
      PID:1248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-SPP/Perf"
      4⤵
      PID:1748
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
      4⤵
      PID:2428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Security-Vault/Performance"
      4⤵
      PID:1888
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
      4⤵
      Clears Windows event logs
      PID:3780
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
      4⤵
      PID:5560
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
      4⤵
      PID:4412
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SendTo/Diagnostic"
      4⤵
      PID:3912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sens/Debug"
      4⤵
      PID:6136
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SenseIR/Operational"
      4⤵
      PID:1000
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sensors/Debug"
      4⤵
      PID:820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sensors/Performance"
      4⤵
      PID:6032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
      4⤵
      PID:3856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
      4⤵
      PID:4576
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ServiceReportingApi/Debug"
      4⤵
      PID:5944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Services-Svchost/Diagnostic"
      4⤵
      PID:2636
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Services/Diagnostic"
      4⤵
      PID:5044
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Servicing/Debug"
      4⤵
      PID:5028
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Setup/Analytic"
      4⤵
      PID:5012
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SetupCl/Analytic"
      4⤵
      PID:1276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SetupPlatform/Analytic"
      4⤵
      Clears Windows event logs
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SetupQueue/Analytic"
      4⤵
      PID:2796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SetupUGC/Analytic"
      4⤵
      PID:4348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
      4⤵
      PID:3804
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:2540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
      4⤵
      PID:3772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
      4⤵
      PID:5496
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
      4⤵
      PID:6080
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"
      4⤵
      PID:1224
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
      4⤵
      PID:2724
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"
      4⤵
      PID:4820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
      4⤵
      PID:5896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"
      4⤵
      PID:6024
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-Core/ActionCenter"
      4⤵
      PID:5280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-Core/AppDefaults"
      4⤵
      Clears Windows event logs
      PID:956
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-Core/Diagnostic"
      4⤵
      PID:5128
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"
      4⤵
      PID:5912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-Core/Operational"
      4⤵
      PID:5444
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
      4⤵
      PID:4080
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"
      4⤵
      PID:4904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"
      4⤵
      PID:2284
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-Shwebsvc"
      4⤵
      PID:3488
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
      4⤵
      PID:5832
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"
      4⤵
      PID:620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"
      4⤵
      PID:4620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Shsvcs/Diagnostic"
      4⤵
      PID:4472
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SleepStudy/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:4524
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmartCard-Audit/Authentication"
      4⤵
      PID:4572
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"
      4⤵
      PID:5612
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"
      4⤵
      Clears Windows event logs
      PID:4076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"
      4⤵
      PID:4208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmartScreen/Debug"
      4⤵
      PID:5100
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmbClient/Audit"
      4⤵
      PID:4364
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmbClient/Connectivity"
      4⤵
      PID:2312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmbClient/Diagnostic"
      4⤵
      PID:704
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SmbClient/Security"
      4⤵
      Clears Windows event logs
      PID:1996
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
      4⤵
      PID:6120
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Spell-Checking/Analytic"
      4⤵
      PID:5032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SpellChecker/Analytic"
      4⤵
      PID:248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Spellchecking-Host/Analytic"
      4⤵
      PID:4072
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SruMon/Diagnostic"
      4⤵
      PID:4716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SrumTelemetry"
      4⤵
      PID:3540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StateRepository/Debug"
      4⤵
      Clears Windows event logs
      PID:984
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StateRepository/Diagnostic"
      4⤵
      PID:4152
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StateRepository/Operational"
      4⤵
      PID:3036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StateRepository/Restricted"
      4⤵
      PID:1540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorDiag/Operational"
      4⤵
      PID:3100
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorPort/Operational"
      4⤵
      PID:3360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ATAPort/Admin"
      4⤵
      PID:5192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ATAPort/Analytic"
      4⤵
      PID:4192
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ATAPort/Debug"
      4⤵
      PID:6112
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ATAPort/Diagnose"
      4⤵
      PID:1920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ATAPort/Operational"
      4⤵
      PID:1460
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Admin"
      4⤵
      PID:4248
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Analytic"
      4⤵
      PID:1360
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Debug"
      4⤵
      PID:3564
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"
      4⤵
      PID:5508
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Operational"
      4⤵
      PID:4748
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Disk/Admin"
      4⤵
      PID:2664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Disk/Analytic"
      4⤵
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Disk/Debug"
      4⤵
      Clears Windows event logs
      PID:2032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Disk/Diagnose"
      4⤵
      Clears Windows event logs
      PID:5884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Disk/Operational"
      4⤵
      PID:5608
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-NvmeDisk/Analytic"
      4⤵
      PID:1476
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-NvmeDisk/Diagnose"
      4⤵
      PID:4148
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-NvmeDisk/Operational"
      4⤵
      PID:6140
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Storport/Admin"
      4⤵
      PID:5924
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Storport/Analytic"
      4⤵
      PID:4592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Storport/Debug"
      4⤵
      PID:5936
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Storport/Diagnose"
      4⤵
      PID:3376
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Storport/Health"
      4⤵
      PID:3308
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Storport/Operational"
      4⤵
      PID:3188
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Tiering-IoHeat/Heat"
      4⤵
      PID:2760
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storage-Tiering/Admin"
      4⤵
      PID:5680
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageManagement-PartUtil/Operational"
      4⤵
      PID:3184
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageManagement/Debug"
      4⤵
      PID:1340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageManagement/Operational"
      4⤵
      PID:2112
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSettings/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:2056
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-Api/Operational"
      4⤵
      PID:3008
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-Driver/Diagnostic"
      4⤵
      PID:5580
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-Driver/Operational"
      4⤵
      PID:5340
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-Driver/Performance"
      4⤵
      PID:1172
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-ManagementAgent/WHC"
      4⤵
      PID:4260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-Parser/Diagnostic"
      4⤵
      PID:5464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-Parser/Operational"
      4⤵
      PID:1692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic"
      4⤵
      PID:1728
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageSpaces-SpaceManager/Operational"
      4⤵
      PID:4708
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageVolume/Diagnostic"
      4⤵
      PID:5428
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-StorageVolume/Operational"
      4⤵
      PID:5584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Store/Operational"
      4⤵
      PID:3392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Storsvc/Diagnostic"
      4⤵
      PID:2300
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Subsys-Csr/Operational"
      4⤵
      Clears Windows event logs
      PID:4640
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Subsys-SMSS/Operational"
      4⤵
      PID:5892
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sudo/Admin"
      4⤵
      PID:1384
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Superfetch/Main"
      4⤵
      PID:1008
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Superfetch/PfApLog"
      4⤵
      PID:4812
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Superfetch/StoreLog"
      4⤵
      PID:2768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Sysprep/Analytic"
      4⤵
      PID:1816
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-System-Profile-HardwareId/Diagnostic"
      4⤵
      PID:2916
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SystemSettingsHandlers/Debug"
      4⤵
      PID:5440
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SystemSettingsThreshold/Debug"
      4⤵
      PID:1244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SystemSettingsThreshold/Diagnostic"
      4⤵
      PID:2144
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-SystemSettingsThreshold/Operational"
      4⤵
      PID:3196
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TCPIP/Diagnostic"
      4⤵
      PID:6088
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TCPIP/Operational"
      4⤵
      PID:1736
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TSF-msctf/Debug"
      4⤵
      PID:3668
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TSF-msctf/Diagnostic"
      4⤵
      PID:716
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TSF-msutb/Debug"
      4⤵
      PID:1964
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TSF-msutb/Diagnostic"
      4⤵
      PID:4564
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TTS/Diagnostic"
      4⤵
      PID:6032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TWinAPI/Diagnostic"
      4⤵
      PID:3856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TWinUI/Diagnostic"
      4⤵
      PID:4576
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TWinUI/Operational"
      4⤵
      PID:5944
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TZSync/Analytic"
      4⤵
      PID:2636
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TZSync/Operational"
      4⤵
      PID:5044
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TZUtil/Operational"
      4⤵
      PID:5028
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TaskScheduler/Debug"
      4⤵
      PID:5012
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TaskScheduler/Diagnostic"
      4⤵
      PID:1276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TaskScheduler/Maintenance"
      4⤵
      PID:1240
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TaskScheduler/Operational"
      4⤵
      PID:2796
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
      4⤵
      PID:4348
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TenantRestrictions/Operational"
      4⤵
      PID:2356
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
      4⤵
      PID:2896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
      4⤵
      PID:4216
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
      4⤵
      PID:1740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
      4⤵
      PID:6004
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
      4⤵
      PID:4252
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
      4⤵
      PID:1648
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
      4⤵
      PID:1260
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
      4⤵
      PID:3164
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
      4⤵
      PID:5176
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
      4⤵
      PID:432
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
      4⤵
      PID:4280
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
      4⤵
      PID:3536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
      4⤵
      PID:1620
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Admin"
      4⤵
      PID:5168
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Analytic"
      4⤵
      PID:4792
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Debug"
      4⤵
      PID:1120
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Operational"
      4⤵
      PID:4108
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
      4⤵
      PID:4920
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
      4⤵
      PID:1056
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
      4⤵
      PID:4084
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
      4⤵
      PID:5088
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
      4⤵
      PID:5076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
      4⤵
      PID:4584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
      4⤵
      PID:2744
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
      4⤵
      PID:2848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
      4⤵
      PID:5768
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
      4⤵
      PID:5980
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
      4⤵
      PID:5516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
      4⤵
      PID:5624
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
      4⤵
      PID:2516
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Tethering-Manager/Analytic"
      4⤵
      PID:912
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Tethering-Station/Analytic"
      4⤵
      PID:1356
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ThemeCPL/Diagnostic"
      4⤵
      PID:4772
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-ThemeUI/Diagnostic"
      4⤵
      PID:4304
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Threat-Intelligence/Analytic"
      4⤵
      PID:4688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational"
      4⤵
      PID:4972
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Time-Service/Operational"
      4⤵
      PID:3208
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Troubleshooting-Recommended/Admin"
      4⤵
      PID:5368
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-Troubleshooting-Recommended/Operational"
      4⤵
      PID:4392
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-TunnelDriver"
      4⤵
      PID:2904
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
      4⤵
      PID:3740
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UAC/Operational"
      4⤵
      PID:6116
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UIAnimation/Diagnostic"
      4⤵
      PID:1540
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UIAutomationCore/Debug"
      4⤵
      PID:5364
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
      4⤵
      PID:4988
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UIAutomationCore/Perf"
      4⤵
      PID:3860
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UIRibbon/Diagnostic"
      4⤵
      PID:4536
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-MAUSBHOST-Analytic"
      4⤵
      PID:4700
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-UCMUCSICX/Operational"
      4⤵
      PID:4588
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-UCX-Analytic"
      4⤵
      PID:5688
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
      4⤵
      PID:3448
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-USBHUB3-Analytic"
      4⤵
      PID:4896
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
      4⤵
      PID:3584
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-USBXHCI-Analytic"
      4⤵
      PID:1592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-USBXHCI-Operational"
      4⤵
      PID:3312
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic"
      4⤵
      PID:1848
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UniversalTelemetryClient/Operational"
      4⤵
      PID:5236
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
      4⤵
      PID:2664
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
      4⤵
      PID:2204
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Control Panel/Diagnostic"
      4⤵
      PID:2032
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Control Panel/Operational"
      4⤵
      PID:5884
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Device Registration/Admin"
      4⤵
      PID:5608
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Device Registration/Debug"
      4⤵
      PID:4968
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Profile Service/Diagnostic"
      4⤵
      PID:244
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User Profile Service/Operational"
      4⤵
      PID:3364
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User-Loader/Analytic"
      4⤵
      PID:1676
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-User-Loader/Operational"
      4⤵
      PID:5924
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserAccountControl/Diagnostic"
      4⤵
      PID:4592
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserModePowerService/Diagnostic"
      4⤵
      PID:5936
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserPnp/ActionCenter"
      4⤵
      PID:3376
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserPnp/DeviceInstall"
      4⤵
      PID:3596
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
      4⤵
      PID:1076
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserPnp/Performance"
      4⤵
      PID:2820
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserPnp/SchedulerOperations"
      4⤵
      PID:2856
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor/Operational"
      4⤵
      PID:3276
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserSettingsBackup-EarlyDownloader/Operational"
      4⤵
      Clears Windows event logs
      PID:4132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UserSettingsBackup-Orchestrator/Operational"
      4⤵
      PID:3288
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UxInit/Diagnostic"
      4⤵
      PID:5132
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-UxTheme/Diagnostic"
      4⤵
      PID:3464
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VDRVROOT/Operational"
      4⤵
      PID:2756
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VHDMP-Analytic"
      4⤵
      PID:3528
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VHDMP-Operational"
      4⤵
      PID:3056
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VIRTDISK-Analytic"
      4⤵
      PID:3616
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VPN-Client/Operational"
      4⤵
      PID:6036
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VPN/Operational"
      4⤵
      PID:4112
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VWiFi/Diagnostic"
      4⤵
      Clears Windows event logs
      PID:1976
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VerifyHardwareSecurity/Admin"
      4⤵
      PID:2556
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VerifyHardwareSecurity/Operational"
      4⤵
      PID:2320
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VolumeControl/Performance"
      4⤵
      PID:692
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VolumeSnapshot-Driver/Analytic"
      4⤵
      PID:4128
  - - C:\Windows\system32\wevtutil.exe
      wevtutil cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
      4⤵
      PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\MSVCP140_1.dll
Size 26KB
SHA256 b2113956aa3fcb9decfe65be1ee7829f8e3ae0899633ae89fe04888ada201594
MD5 125fd152497716d47a5ede1b3e815e53
SHA1 2bdb19c06b7ace945f1ab8a6c7cc74c5bdd4b8bd
SHA512 c91256e08c83fa4e31dd157cef52797bea2c7c4279a210946dea8c518f1aeb35411a292130a3357b8eb84e28b6b02c9f6f8ca539756c7747c576f123747fe445
SSDEEP 384:3ju2J9VQH+qNy09dmFWcS5gW7rHQIYiu9cQrPwiy8RbmL4nNyq0dzS:a8QH+qNy0PmgN5YiuiQrT5AL34
TLSH
T103C28D43EA108C04EC278934D8C69D6AF676F5904F92C3CB6359821D0FA63C379BE769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\MSVCP140_2.dll
Size 265KB
SHA256 1b806b427ffb573deff8478cf6fe336465fe2c67e0919bb95f452b6f31d25736
MD5 45168441e7a93ac535ddb91ab61a3f07
SHA1 cee7e8c119cbcbb1a16b354e5e5f3ed18e74349d
SHA512 b00f8c41d1759364ef7fa25b2a2317d9fb3f2c1eeb02135119106746737124b38f07b0a93bcf2776176cde1242e9836726905ac66a6aea504c50236e71b5e5b9
SSDEEP 3072:1J51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD791:1JbjwvnQo/iy5L/XxTWrm
TLSH
T196442812B51A2EBFC5D6E8B04939B416FC223A418775C48A57C31C8D9F2BA533FE3529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\Qt6Core.dll
Size 10.0MB
SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
MD5 d07506bad82cadd91c4224b6b35141a3
SHA1 49194338604e1b7539eb32dd20a68257bbf03a5b
SHA512 03f22f28d7c85e41e760789f22efdc0f866ee57e6086950abd27a9d60f78e5bb3ab8f898bcef72088fdaf93cb14026b19415fb312925b7c249f1b09362732c45
SSDEEP 98304:WeAbhLTfRmoOKFdu9CwJsv6tnYNJMAA1gcV/3cNuWXelP:Whn8KFdu9CwJsv6tnuSA+/3cNuWXe
TLSH
T1FAB6390766FA0102F6FBDA34DAB75116DBB27C466B3096EF025861185D337F09E3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\Qt6Gui.dll
Size 9.1MB
SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
MD5 e7795ee952f42fe29167d40f2d60fc4a
SHA1 a1e7c139907edbbb1cac1908fcc4955e0d954f50
SHA512 642aa37d4eaf3c2a35df486677a34aa486d56e490004082b68bfd389a24d6eb13b46f64109a38e4a3d45177787996f2d27fdf2cafed7fd7c729d5acf9ed51066
SSDEEP 98304:mfrUrVK+HdzDGqLVUkG/9r1hzJbgseVxDVkqtjuQQ2S9:mfABfzDnUfr1hzJb7QxvjBQX9
TLSH
T1FFA68D57A2A911D8C47BD13C8B9B9517EBB2701503529FDB01A5CA162F33BF12ABF321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\Qt6Widgets.dll
Size 6.3MB
SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
MD5 7471042f39416dd8bf0cc4202da5e3c3
SHA1 fa39f5afe9cd90b6ad9ae6ac3a0ae0924fb12e91
SHA512 bdf07280ac384ab11324c763dd9a7ee2208e08ca92f773da7c7f953a00029dbb512006948dd51c52199464c3fae188ec1b62c26a730afe1879f909a5ab8d7a7c
SSDEEP 98304:WM+neySH06w0WYXVxRjYqnzIjWyHTM1R6wtO0MP7:WM+neym06wvYvRjYqnzIiyza6KqP7
TLSH
T174666A5763EA0185C4ABD13DCB4B8A17EBB2700453629BCF0265CA592F737E22E7E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\QtCore.pyd
Size 3.2MB
SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
MD5 938146ea00d1ca246284e60b8da29c3d
SHA1 c04644ccbeedbe3ee0b853b1033ff63235fbe5ab
SHA512 90c113e603ab0f1e805526e5d918db9ef61c99b465353c9a5b46023482f023dde19e70b78a5fc474d3ef4c2cccd3ac8a7250967fe5c4d8848f670a67d91ad48d
SSDEEP 49152:wPhpi4wSOtPtQkPa8RQV8T5Rp/o4BHhTK9NvE8BRVzBvTfNfQwPsDXQ4XipL1/ip:Tu2S1f+T
TLSH
T1B5F55B9F93990180D73BE1BDC90B4A07D2F234924596F30B556ACC686FD73A2276DBC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtGui.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\QtGui.pyd
Size 3.7MB
SHA256 f0549716b10a8b4fbd5c6c041f36af215223809f919f4c4722d44cc199d5c593
MD5 9cbac8b3e6451cf0753fb23aff3e0531
SHA1 f0b6d996b0333befbe06911a406cb9a03e1c6561
SHA512 476e0229b68d98316508833d9222a74c692f730321074dc5cfd41a07258a402cdfc880219b365d22f10ada87962a8cb1e77ae0c4f0681ec438d51ba9074217b4
SSDEEP 49152:QTrFX9cDWXnsZ5m1soFA/2EypFMTifWNBmMd3ODenSrtPtYbst6SCAXmZ212KttR:crY3DSrZh9Dp
TLSH
T10D065B9B97A901C0D337E07DCD079A17D6F2349289C5A20B5465CC685FE339327AAFE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtWidgets.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\QtWidgets.pyd
Size 4.6MB
SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
MD5 2a975020d309bc29f387adefa021d8a3
SHA1 db35a959b6a467a22757c79933b3f4ffecdd0acb
SHA512 c92d0ae567d4bc871a8c18a3b45c6d455ae8f4ef90b8734b81e9425fe968aa61ef64c1b1c7388a3ef85a9675f351cd65925a054f201fecf0b73c953bfceed9a0
SSDEEP 49152:94PUkIaMVUqR1P7Sb0BsEUMiruqdHey98SQWOmzuMBcrf/nyTNijt/rdn7U/uea3:/hmK/VDylKilLgj7j
TLSH
T13B265CDF676A05C0C27AD27DCD0BAA17C1F2B4C68885630F4866C9AC9FF37862655BC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qdirect2d.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\plugins\platforms\qdirect2d.dll
Size 1.0MB
SHA256 f099af483b0d71a6a028bc15ad98a407e4c820400e6626cdc8e66b5f5e4cfed2
MD5 e367a674bb36f51cecf867e43c5b4000
SHA1 e8c6f5819dc80cfa2c9f43e350796eac905a260f
SHA512 de8dc6c1b3ee5bb01d97ed86ff8b25bf4dae1b711161c015f0ba234dec93a216f936b49409699523691c7463419cf3732f1f5b929b4ead7b100704499c54d95f
SSDEEP 24576:afJXy8aZgh39pNmmXnzmBwD0ns9xNJytK1:QJXy8rlmcnz8nIzJytm
TLSH
T1DA356B1B77B80295E43AD0BDC78B8642D6B2701203618EDB45A1DE1A7F337E72A3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qminimal.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\plugins\platforms\qminimal.dll
Size 60KB
SHA256 97d81b9ee7cbbeb68e46eefce24d4b929b7a24cc646cebe3d4d03e2734f97935
MD5 cdadf61880b8b8e3da8557d55070f1fa
SHA1 c4b8f80809e7c3f34bab01765d486839d2234eaf
SHA512 083795b0e7ebbce46c2f46e029fc90f289c97724732f44aacf603150c43c0b2942f3a96733efd3266886b2e294761cecad78aacbcf92baf770da84c02c26b065
SSDEEP 768:kRkPddegaLP/vonN13x/ee17cff+TilM06ogrkwvQHRIPVJ5Yiuiu5ALw:kRkbar4N13xme17ctHRIPVX7uZ
TLSH
T174531A021A350495D8368B7B81DB4E166835F2240B539FCF702B815E6FB9BC2397D6FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoffscreen.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\plugins\platforms\qoffscreen.dll
Size 111KB
SHA256 426266e8ba0ea07c416616ad9973702fe126d4559cb2ee11e1c9bdbae85ba755
MD5 99b5d223185e97b617ad6977f0e5c3eb
SHA1 8f6b1e4b360c6bf948c8cede045b15a74e091f51
SHA512 60a08e6bf506ff616adfe7d3b8f96d1b6e52e27c4c0201d0eb95c65d428bc86f59ec6269298088c0b5cc359fbbf24faf9ac3edde5013bb51bb80f3c2b90bc424
SSDEEP 3072:1h64KOpNdP6DPiIQIEDJp683J5JoyApGQXcabP:1hbZnmKDJpB3J5JoyApGQsC
TLSH
T1EAB3395226750085D836DA3AC2C70D26EB32F0140723DFEF615A415A6F6B7D22E7C7EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\plugins\platforms\qwindows.dll
Size 983KB
SHA256 54d736de022f707e9f7f555e4c9f9e993253cd5b0ee2364e6a9458c180828c42
MD5 14e655d821b00b776668a3b6cdde1966
SHA1 d5eaf4fedf88c18da0a03540e6eb2855c21c9c29
SHA512 cc02459a9d419c564f9c9f1d37e887a7904f328cff3a87bd1d379151b8defd2d9bff1f9a97406df863c7d7846286084578eecc5f8bbb3605c7fe5f6580923638
SSDEEP 12288:lTtxVV2OA9YVQaF/pWjuh23xnI99zp4ztJ1IiYoxQIWBU7OPJ9eR:lPNjVQaF/pWjuh23xITzp2tJ1IiYXjeR
TLSH
T164256D1B63A80295E83AC07ECE5B8712D6B3746903A186CB4161DD1D7F377E23A3DB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmodernwindowsstyle.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\plugins\styles\qmodernwindowsstyle.dll
Size 225KB
SHA256 9af96b09ebaf7ff13e22c70bf69b9c3f226f069375d1a9f9efd63e944e43f5fb
MD5 d672a86e9db9a1e40fbece9d2ce8751e
SHA1 dc343d441f19ef6bef8c0a9238d274aaa5a6d907
SHA512 1d4b51c636c2a36181b202edc8a3712148752d2b2f6a90daca0f66f2b13908744bdc4d98e041e3ad3c3c586dfa69f50013247cd6c8f2f21ab76d67858913012e
SSDEEP 6144:j2y6vOA/YRGmdZuEzvuG4PF0Odu2yydm6DS4oypnZSlvqmqiE6csuN:j2jvOiYRGuZz+N
TLSH
T15F341803739216C6C967C2B8C61B8A23F67330544356DAFF4167CAB42F632E2BD3A655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyside6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\PySide6\pyside6.abi3.dll
Size 242KB
SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
MD5 a4a8f3b778b78e46246b1ad658f577ed
SHA1 44749d0d28f8ec7122b5ec238f6d505d0918d26f
SHA512 4fb1cc16bd7feb46833f0f21071683ff47bfe6225a4efc27106b0509e56b4a28c8d184adc84dbbac94ac83327f4335d1ea1aec7dfadb2f8e5139cb3c0066329d
SSDEEP 6144:IEzkiZZnST8nH/oACtcwW1JucudQM2k8XRrWLxR8NDYXH:4T8QA/Bwcuz22Pb
TLSH
T198345C6B33445E99DEAFC279C902850AD2B3B4120361E34F03B5DBA65F6B3933A1D746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_bz2.pyd
Size 85KB
SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
MD5 207d4a4b7a113ef494514918f2dccdf3
SHA1 74b59453b5bb6194e0d2587d26d499d0f7e1aed5
SHA512 f7e5a2608ee19fd400d4bfe27e8603289a219af6a4a4a9e65ebb76c715d926fb9b08293fc2a3fed2195784804764265fa0b356547f23c501ec8ff9487c948b27
SSDEEP 1536:xtMtz7eksNCb6YVVEFxO2RqOyuzotWw8pRbIiQIG3VTy1Ni9QfIY6utw:PMtzSqurjOqqfgotWrplIiQIG3VtKtw
TLSH
T14A837E86B3B462B6F59B81B496910353F730FF960710A3BFB25482863F13B91AF58365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_ctypes.pyd
Size 139KB
SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
MD5 eeabc0c7756ed7a29e33e467c398737f
SHA1 ec5c401946a9df4e4ab764ddb4639e4e33e1ce40
SHA512 5e1e93545e1be34880fc680ca12004792076e88baa6cac4512fdbbdb90091a9ae441a16b8d24f64c6b03bf14903babddecfa783ce5c016759ed790c0eabc189b
SSDEEP 3072:G/n1qQ8/27N56EBZrGwrb1OzIJswKRW2r7rw8IGGPzoGc:wn1JDT6wrszIJfUDwtc
TLSH
T1A3D38F4B336841E6DA678138C6739E47FBB1F4511A10878F4264C99B2F637A2AE3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_lzma.pyd
Size 157KB
SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
MD5 cada2b240b280f172aeb32a1666b21e6
SHA1 c15dc39329444433c255309eb89bae188aae1b22
SHA512 8b12298efd28549d46e2c48cff94b07039cf513bbac25063ebad8bae57b96e07eefd7df82229441af142c1b96dc837dec468263c0873d14da280e3ed6e42eb9e
SSDEEP 3072:BJ66g4T5QW7JfyjEqkSkA51b4pznfJ9mNopUpdbQIGI1HFk:BUR4Tp4QPZ8N4RxYOgbPa
TLSH
T110F34C86B794F0E6F7328C38D2624F57E6F578590320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_uuid.pyd
Size 27KB
SHA256 a09308efd309732e3745e70b4456235579c450cac32bed616dfb3913b56f6637
MD5 cc5b77a3dd4cc06a0b9c760a0b0c5c15
SHA1 d88f44420c5819b631b3e332dc4903eb620cf216
SHA512 2dc3d66a8f5b75e194e5511a868d6b110083958c3b0a77e9ac301277c550806295f450cb077119d7b00b129793af39a8b348650fcf50af54d153462b9f570903
SSDEEP 768:it15cQIGIwFy1KPuBL2Ip4NTxf1mlRaXVCEI:it15cQIGIwFy1Ni9nfIYVo
TLSH
T147D26C8A9A748043FE638770D1F6DE83B939BBD3591157AB316991860E133C1E31B3AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\_zstd.pyd
Size 491KB
SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
MD5 035b0a033dd00dbe887556f4d4b852c3
SHA1 e86cf52d825f9b68177354c54edaa57e962012c3
SHA512 0b428aa10a9e977e07023918870368a9c00e0eb4ab4f7cf1e88950d4aebd2ba5774ebea9f3779d05e370bbe315da6634922834106077d511b710c6131d29dc65
SSDEEP 12288:KccWmYLKvveeFSeX0ro+Q2J5BCl9VNqdp:KccWJKvveeFSeX0roMZdp
TLSH
T143B48D43F29943EDE53BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\base_library.zip
Size 1.3MB
SHA256 ec078e0c8181aa2806591b689e0409065b34f6fb8a7b27fdc31876c2afd786ca
MD5 d2e209220d1d840c2f1b64af3b169563
SHA1 59b210fd708cd35dc59a13894c1d9f4568d1ad43
SHA512 9560f40434a5abf3465a850a1429e7cf15869994bbdd510dd0fafca05cf9a0fd8452fa07aeec9dfc99c93334c1fec4e12b05e8e4121220344bdba1841a47c63f
SSDEEP 24576:hBRpSyLnRQeOdP2m2df7YaQZylb/CuUF2dvo:3R9/TYaYuUF2dQ
TLSH
T16E552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\python3.dll
Size 72KB
SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
MD5 a5495a547b4218148914469f1ee65d47
SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
TLSH
T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\python314.dll
Size 6.5MB
SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
MD5 006b0746b5abaf438d1bc753261c6d2c
SHA1 8f34714617f376cfa6e7e2aedc1e2a73de8c8fd8
SHA512 1c156c3f542de0a27e16ca5b7d6bbd34f2059b380ce85dbcfd5ae3a64de473fd160baba45ca30ad85dfe45742fdcb42aa969cbbaab26a569e324d4e65fb6d621
SSDEEP 98304:xVyDBH+ULEfi0VOuZd+FAX/uv3HDMiEEQn0rt:xVyD1+ULW5VrZRxim0rt
TLSH
T136669D26737901A5D9BB8035C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\shiboken6\MSVCP140.dll
Size 536KB
SHA256 005f2324c7ff79bbe9a44992b0708abb4c871bd24bcc7a34aca5eab4439c1f4a
MD5 db5a33e3d927fcda8d0f3013504f0928
SHA1 c4d101c530a77a0c04e030427f5bf8530ca82665
SHA512 0f4291e1969e50d7d503d5b81d491ef047234639b1d282279c24a960ca691516b5d6d291fa1c79b55edb93c71afcf608500f8377a3a43628c9a59c1575579af2
SSDEEP 12288:fdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa6z:fdnGoU/7m/V5WZ8dQEKZm+jWodEER7z
TLSH
T16CC42A27F74A06B0E195E3B8A1838702D7F1BC498322E3C752EB955D2F573D0A67B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shiboken.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\shiboken6\Shiboken.pyd
Size 32KB
SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
MD5 da10bfdadc7dad176221e1cb649dddf5
SHA1 3d9e524cbe29ab4a95dc8afed32e0eb9b51d3251
SHA512 ffc75f77f7657ef9c78818fc7cebbda56ecbd39b11098a4dc8fe73f0388fcc1cd88c55a16bb9a5364546fabff3a3efafa3c358215411ea610b58979db6d0c8ec
SSDEEP 384:CBFBhadkk14n3CwmRk3RkbR3mQtbScd0a9upvHQIYiu9cQJwZTy8RbmL4nNy8n6:OBMdkl3OmhYJmAmceeiP5YiuiF95ALm6
TLSH
T1A9E29E438D24648DED21D67A80868D1AE1F1B1560751D3CF136BD1EA5FA33C23E3E7AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\shiboken6\VCRUNTIME140_1.dll
Size 40KB
SHA256 e4d7ea5f4f4ff6d0c208e693853617cdef0ad71cfe5dd5c3ae16c8a6b64c18ea
MD5 399cebff0f39661153379655451163f2
SHA1 1f8a712990d6534af4af503666861356ff7adb9b
SHA512 923c0e9dd7f9544076e8f0d3efd8af61ee1f9b063641287e972b293273c1f0d805fae2e45d3fc6c27dcba5588e2cddd7e7c238df0efb7f4729ab9b22fe26f35b
SSDEEP 768:h3oZYctpzcx0pdESASv83m5YiuiCOp5ALg:5c6wk3c7uDy
TLSH
T14E037CA297B41856E06BD975C0D32E3BEB71F4651B9083CB03A8825D1F627C07A7E367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shiboken6.abi3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32922\shiboken6\shiboken6.abi3.dll
Size 375KB
SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
MD5 2de027ce82d964b55f71c01fcad2f6de
SHA1 01a61145f111ebaa840f93d0081b1f8327ca6df1
SHA512 3a4b538045380948cda89de3809b350ac51aabf2f7af33a26d2bdacb98f1a2b4aa8452342c749281c16e2f7788bd7919982b219bd8e033460ceca634ccebafaa
SSDEEP 6144:lNjK8duskXY9Fc/BnFGFmuDPgiNkbOdxFF2PejUosGfJXPYVIfwcY:fduqA/BAXN1sPeQosGfBnc
TLSH
T144847D27AF5410DCE67B927C8562CA06E27670A6035097CF23F9C2D52B63AD53A7EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LIBCRY~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\LIBCRY~1.DLL
Size 6.0MB
SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
MD5 4191d4288230515c5098cc07f699a604
SHA1 bd8b4d48b2f4513dc378bc5a4cf4a3abbc6998d8
SHA512 c110a89ebb5b58126d556ffea1bf01efb4a6dd295f7387665223741a171d9353315de4d361d3d02a186c1c659aee20f46c579efc51b4c41f7282e1b5b4d6d040
SSDEEP 98304:ybM11p6ZVTRwlFh7V6v73WyXTf0W+JJe1CPwDvt3uFA0CaI:ybM1T6ZlalfV6v7GyXbnEJe1CPwDvt3T
TLSH
T1E6566B5EA7A80188E4BAD13CC6534627D2F1F85A5BB097CF05A196790F33BDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\PySide6\MSVCP140.dll
Size 536KB
SHA256 708dd7bbc7bd23bce9e93f7837a70c2dd7ad55cff43801e92c0f7fcd7dda47cd
MD5 f15280ce3eeaf38c9a4069dead5cd0b4
SHA1 3cd85b7e4359f4aab7812eae20e654d0b0194060
SHA512 f3fd7aae6c5b1a6a47fa199f8c5ceda606f0b184bbc7b70c3348122f4c371339c069c8d747f48d1b20366f48bec5381f7a987636f05900989e4559d4d948faca
SSDEEP 12288:mdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa6t:mdnGoU/7m/V5WZ8dQEKZm+jWodEER7t
TLSH
T191C41A27F74A06B0E195E3B8A1838702D7F1BC498322E3C752EB955D2F573D0A67B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OPENGL~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\PySide6\OPENGL~1.DLL
Size 19.7MB
SHA256 4a7d90f91fdecb5df7b426bc2d05974b8d7ffa450af2d1f93f3eca05800718da
MD5 ae9040fd5f63715e9470bca6453de87f
SHA1 1bee7caf13706a9b1e53b70f4f3ce30f2def7df8
SHA512 db678c8ee2337629dc688a76153176da75cd947da8b1b65316936b3fad0e67b7ec2df44e3d929300b7d17bf2e7bd589b21d2ad3adb83888bd52df39cc6402538
SSDEEP 393216:ov6MzbMYyFwRwwQ+/TuZrgAaSHdjli5TXe/38gJy3kU0de2VlkRaVc:zCi1dfQuc
TLSH
T1C3278B5A72A401D8D57BE17CCA536A07FBB178490321ABDB06F44AA62F23BF1163F351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\PySide6\plugins\ICONEN~1\qsvgicon.dll
Size 70KB
SHA256 dd60826f1959faa7ea137e00959717450da9f2e0c151054daeff1e9d1226fab2
MD5 804edf48ee37fd06ad5a2db2241e794d
SHA1 c4cffde2bcb21cbd3a43e86e41aa98f7aea552cd
SHA512 3458b0d935433c42d2f6a398d79b7f48b4e2086fefa977895dc3e82e0d281e9861b8a0d9ceae3998bbac260ce893eb6558f7ead9e5ca95c4b1f562b1988f104c
SSDEEP 1536:CAaqA/RCDOhLqWyybvXKmZHyHkkaB1L0EfzR3RSoyfAuHPMN7uww:9aIqFTdSHkkaB1L0EF3RSoyfAuHPMNVw
TLSH
T131636B536BA41449E87BD63DC317861BEE72B41427A1E7DF13A1C8362F63BC11AB8361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\PySide6\plugins\IMAGEF~1\qgif.dll
Size 46KB
SHA256 8b8dea2abaed333f1fbbdf3c8867ceb6040722c88a1fb81ea451f8b8bc9e8ee0
MD5 003dbfd3f23bdb42a1255c5952f05090
SHA1 15a3706079ae05ae2a5502670950a75c0c33a154
SHA512 2bdc1ac905f1d0e84d3c57cbde45a9d4943889edbad7f613d1ad979a75eb9a5a8dae95b5018ee9fb368af41120827d6a54094f8b9aec65c17364acd86dc3efdb
SSDEEP 768:3pTlEV6wdBj3NpVt/Mqs0VOIEmmfcyjcocTQW5YiuiC5AL3OB:5TlEkw3j3XDB/VPmfcyjc1Qs7umOB
TLSH
T18B237C86ABA044D8D513C234D8964E2EEBB6B9504B92C7DF4221862E1F337C13E7D769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QTUIOT~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\PySide6\plugins\generic\QTUIOT~1.DLL
Size 98KB
SHA256 1ee2810eef83dbb2740d4f796f8149dc5752ffd3dd60e39796a9a4d6a6a0ae38
MD5 abc61c45c7dde41bed669aef1f33ef86
SHA1 c4b4a5fe10d836f2ffb79ff1db0965806d22b52e
SHA512 5f834ee7b79105a7bbb11b1c9847c42949bf496314b639f10729afd688b73f66a453ee72869b5e96dcb89f9e2ee3204f7653d91e0d059d5a1c68b91f3f8ef312
SSDEEP 1536:V4QUQ0iiCKyF/7sn2Kc84Qtc0EZY441QDjOdl0DmQPPytoXUYJm7u21:V4Q90ipKyL8M011QDjsfQHytoXU4mt
TLSH
T14AA36B7B129042D5D936D279D79B8A1BE372B06517318BDF02A4974A0F33BE12E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32~1\libssl-3.dll
Size 1.3MB
SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
MD5 d99207e7e513f87ad7571c4c2450771b
SHA1 b904eb3989c9a1ad77e3a541e40d84ae890e3df7
SHA512 bccd034e633b96c2c7dff6ca96c2bb8a8c0f90a872f256e8467e470ed57fc4b442c74da488b258b5a255feba26767a5c95293a636c94c754e2644ed91c5be7ac
SSDEEP 24576:gk2RrDo2iVOF8hXN1hyeWsoSvSZlRg5aYsC:gRFDo2uOKJ8sIRg5aYsC
TLSH
T11F556D5AA7B8016DD5B6C17CC6938B23D2B2F41623709BEF06658A790F23BD6273D344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-238-0x000001D87F240000-0x000001D87F262000-memory.dmp

Download

memory/3340-241-0x000001D8198E0000-0x000001D8198FE000-memory.dmp

Download

memory/3340-242-0x000001D819B30000-0x000001D819BE2000-memory.dmp

Download

memory/3340-243-0x000001D87F220000-0x000001D87F22A000-memory.dmp

Download

memory/3340-244-0x000001D87F290000-0x000001D87F2AE000-memory.dmp

Download

memory/5116-225-0x000001A82DD30000-0x000001A82DD40000-memory.dmp

Download

memory/5116-217-0x00007FFFCF240000-0x00007FFFCF6F9000-memory.dmp

Download

memory/5116-214-0x00007FFFCEBF0000-0x00007FFFCF23D000-memory.dmp

Download

memory/5116-220-0x00007FFFCDEF0000-0x00007FFFCE2AB000-memory.dmp

Download

memory/5116-204-0x00007FFFD34D0000-0x00007FFFD3803000-memory.dmp

Download