f06dcdb4f1217da75276668a04fe2cbaacf540364484c913f8d935dfff509df7

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe
Size 7.6MB
Sample260818-ft7msaem9y
SHA256 f06dcdb4f1217da75276668a04fe2cbaacf540364484c913f8d935dfff509df7
MD5 210862b9b8f6e6132a6e575b3cf51309
SHA1 579ae4646baa0b8b03237d4c6de2b462b959bf5a
SHA512 b1f897f22e78413dadcf508a84d8227f409194720afdabe993808cdf8c8e704c1b54774d6d3ffefdd0cb8c799d7a43d0e508737e6117b7287c45488707bb1aad
SSDEEP 98304:V6DpeVlQwY9jVIHhQYWXMmd/8XuO9cBEbtAS2sPBqbnYzfay+4e++KYb:VxQvFwp9cCRuWK2Y
TLSH
T174865A43E6A290ECC16AC074835AA233FA32BC5D45357AAB5BD4CB313FA1F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	disable_win_def
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	disable_win_def

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
2400	wevtutil.exe
6416	wevtutil.exe
2784	wevtutil.exe
2624	wevtutil.exe
7084	wevtutil.exe
4316	Process not Found
1672	wevtutil.exe
6648	wevtutil.exe
6344	wevtutil.exe
1376	wevtutil.exe
6960	Process not Found
6072	Process not Found
4464	Process not Found
3624	Process not Found
6676	wevtutil.exe
1572	wevtutil.exe
3696	wevtutil.exe
5780	wevtutil.exe
3816	wevtutil.exe
5764	wevtutil.exe
5856	wevtutil.exe
4628	wevtutil.exe
4684	Process not Found
6084	Process not Found
4856	Process not Found
6528	wevtutil.exe
5196	wevtutil.exe
2584	wevtutil.exe
3528	wevtutil.exe
6308	wevtutil.exe
3892	wevtutil.exe
5092	wevtutil.exe
3624	Process not Found
2364	wevtutil.exe
6136	wevtutil.exe
4184	wevtutil.exe
3136	wevtutil.exe
236	wevtutil.exe
3512	wevtutil.exe
6908	Process not Found
1976	Process not Found
4944	wevtutil.exe
6492	wevtutil.exe
5956	wevtutil.exe
6960	Process not Found
4772	wevtutil.exe
6720	wevtutil.exe
2284	wevtutil.exe
3252	wevtutil.exe
5612	wevtutil.exe
4140	Process not Found
1448	Process not Found
1976	Process not Found
2524	wevtutil.exe
3824	wevtutil.exe
3824	wevtutil.exe
1708	wevtutil.exe
3380	Process not Found
6104	Process not Found
6964	wevtutil.exe
4864	wevtutil.exe
4644	Process not Found
5452	Process not Found
7076	Process not Found

Detects command variations typically used by ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 2 IoCs

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 2 IoCs

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 2 IoCs

resource	yara_rule
behavioral2/memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer
behavioral2/memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5032	cmd.exe
1328	cmd.exe
3516	cmd.exe
1224	cmd.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
3480	Process not Found
6540	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4800	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3196	cmd.exe
6384	cmd.exe
6864	cmd.exe
2156	cmd.exe
7120	cmd.exe
1500	cmd.exe
1388	cmd.exe
1616	cmd.exe
7140	cmd.exe
4472	cmd.exe
5936	cmd.exe
3016	Process not Found
5868	Process not Found
4888	cmd.exe
5576	Process not Found
3456	Process not Found
2204	Process not Found
5620	cmd.exe
4348	cmd.exe
5700	cmd.exe
5088	Process not Found
3168	cmd.exe
6072	Process not Found
408	Process not Found
6212	cmd.exe
1196	cmd.exe
4876	cmd.exe
5780	Process not Found
4728	Process not Found
3500	Process not Found
6120	Process not Found
7388	Process not Found
5284	cmd.exe
6304	cmd.exe
5492	cmd.exe
6592	cmd.exe
4920	Process not Found
3448	Process not Found
4104	Process not Found
6724	Process not Found
1608	cmd.exe
1552	cmd.exe
5696	cmd.exe
4840	cmd.exe
7608	Process not Found
5704	cmd.exe
4084	cmd.exe
5812	cmd.exe
1736	cmd.exe
3648	cmd.exe
3976	cmd.exe
2928	cmd.exe
3252	cmd.exe
880	cmd.exe
1212	Process not Found
5560	Process not Found
3232	Process not Found
4748	cmd.exe
4328	cmd.exe
2788	Process not Found
2728	Process not Found
1216	cmd.exe
6732	cmd.exe
6492	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7048	Process not Found
2204	Process not Found

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4800	powershell.exe
4800	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeSecurityPrivilege	5140	wevtutil.exe
Token: SeBackupPrivilege	5140	wevtutil.exe
Token: SeSecurityPrivilege	2084	wevtutil.exe
Token: SeBackupPrivilege	2084	wevtutil.exe
Token: SeSecurityPrivilege	3824	wevtutil.exe
Token: SeBackupPrivilege	3824	wevtutil.exe
Token: SeSecurityPrivilege	7036	wevtutil.exe
Token: SeBackupPrivilege	7036	wevtutil.exe
Token: SeSecurityPrivilege	6376	wevtutil.exe
Token: SeBackupPrivilege	6376	wevtutil.exe
Token: SeSecurityPrivilege	1248	wevtutil.exe
Token: SeBackupPrivilege	1248	wevtutil.exe
Token: SeSecurityPrivilege	5088	wevtutil.exe
Token: SeBackupPrivilege	5088	wevtutil.exe
Token: SeSecurityPrivilege	5740	wevtutil.exe
Token: SeBackupPrivilege	5740	wevtutil.exe
Token: SeSecurityPrivilege	5940	wevtutil.exe
Token: SeBackupPrivilege	5940	wevtutil.exe
Token: SeSecurityPrivilege	5124	wevtutil.exe
Token: SeBackupPrivilege	5124	wevtutil.exe
Token: SeSecurityPrivilege	252	wevtutil.exe
Token: SeBackupPrivilege	252	wevtutil.exe
Token: SeSecurityPrivilege	584	wevtutil.exe
Token: SeBackupPrivilege	584	wevtutil.exe
Token: SeSecurityPrivilege	4288	wevtutil.exe
Token: SeBackupPrivilege	4288	wevtutil.exe
Token: SeSecurityPrivilege	3868	wevtutil.exe
Token: SeBackupPrivilege	3868	wevtutil.exe
Token: SeSecurityPrivilege	1580	wevtutil.exe
Token: SeBackupPrivilege	1580	wevtutil.exe
Token: SeSecurityPrivilege	2304	wevtutil.exe
Token: SeBackupPrivilege	2304	wevtutil.exe
Token: SeSecurityPrivilege	6872	wevtutil.exe
Token: SeBackupPrivilege	6872	wevtutil.exe
Token: SeSecurityPrivilege	4500	wevtutil.exe
Token: SeBackupPrivilege	4500	wevtutil.exe
Token: SeSecurityPrivilege	6948	wevtutil.exe
Token: SeBackupPrivilege	6948	wevtutil.exe
Token: SeSecurityPrivilege	1964	wevtutil.exe
Token: SeBackupPrivilege	1964	wevtutil.exe
Token: SeSecurityPrivilege	3772	wevtutil.exe
Token: SeBackupPrivilege	3772	wevtutil.exe
Token: SeSecurityPrivilege	764	wevtutil.exe
Token: SeBackupPrivilege	764	wevtutil.exe
Token: SeSecurityPrivilege	6480	wevtutil.exe
Token: SeBackupPrivilege	6480	wevtutil.exe
Token: SeSecurityPrivilege	1636	wevtutil.exe
Token: SeBackupPrivilege	1636	wevtutil.exe
Token: SeSecurityPrivilege	2624	wevtutil.exe
Token: SeBackupPrivilege	2624	wevtutil.exe
Token: SeSecurityPrivilege	5016	wevtutil.exe
Token: SeBackupPrivilege	5016	wevtutil.exe
Token: SeSecurityPrivilege	5696	wevtutil.exe
Token: SeBackupPrivilege	5696	wevtutil.exe
Token: SeSecurityPrivilege	5296	wevtutil.exe
Token: SeBackupPrivilege	5296	wevtutil.exe
Token: SeSecurityPrivilege	4444	wevtutil.exe
Token: SeBackupPrivilege	4444	wevtutil.exe
Token: SeSecurityPrivilege	1180	wevtutil.exe
Token: SeBackupPrivilege	1180	wevtutil.exe
Token: SeSecurityPrivilege	3392	wevtutil.exe
Token: SeBackupPrivilege	3392	wevtutil.exe
Token: SeSecurityPrivilege	5664	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 3516	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	89
PID 3516 wrote to memory of 5856	3516	cmd.exe	91
PID 4716 wrote to memory of 1224	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	92
PID 1224 wrote to memory of 4672	1224	cmd.exe	94
PID 4716 wrote to memory of 5032	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	95
PID 5032 wrote to memory of 2336	5032	cmd.exe	97
PID 4716 wrote to memory of 1328	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	98
PID 1328 wrote to memory of 3212	1328	cmd.exe	100
PID 4716 wrote to memory of 1848	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	101
PID 1848 wrote to memory of 1868	1848	cmd.exe	103
PID 4716 wrote to memory of 6920	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	104
PID 6920 wrote to memory of 4748	6920	cmd.exe	106
PID 4716 wrote to memory of 4800	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	107
PID 4716 wrote to memory of 1216	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	109
PID 1216 wrote to memory of 5140	1216	cmd.exe	111
PID 4716 wrote to memory of 4412	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	112
PID 4412 wrote to memory of 2084	4412	cmd.exe	114
PID 4716 wrote to memory of 1140	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	115
PID 1140 wrote to memory of 3824	1140	cmd.exe	117
PID 4716 wrote to memory of 4524	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	118
PID 4524 wrote to memory of 7036	4524	cmd.exe	120
PID 4716 wrote to memory of 3276	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	121
PID 3276 wrote to memory of 6376	3276	cmd.exe	123
PID 4716 wrote to memory of 6396	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	124
PID 6396 wrote to memory of 1248	6396	cmd.exe	126
PID 4716 wrote to memory of 2960	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	127
PID 2960 wrote to memory of 5088	2960	cmd.exe	129
PID 4716 wrote to memory of 6524	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	130
PID 6524 wrote to memory of 5740	6524	cmd.exe	132
PID 4716 wrote to memory of 4608	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	133
PID 4608 wrote to memory of 5940	4608	cmd.exe	135
PID 4716 wrote to memory of 716	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	136
PID 716 wrote to memory of 5124	716	cmd.exe	138
PID 4716 wrote to memory of 3492	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	139
PID 3492 wrote to memory of 252	3492	cmd.exe	141
PID 4716 wrote to memory of 972	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	142
PID 972 wrote to memory of 584	972	cmd.exe	144
PID 4716 wrote to memory of 4080	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	145
PID 4080 wrote to memory of 4288	4080	cmd.exe	147
PID 4716 wrote to memory of 6788	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	148
PID 6788 wrote to memory of 3868	6788	cmd.exe	150
PID 4716 wrote to memory of 6212	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	151
PID 6212 wrote to memory of 1580	6212	cmd.exe	153
PID 4716 wrote to memory of 1608	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	154
PID 1608 wrote to memory of 2304	1608	cmd.exe	156
PID 4716 wrote to memory of 6864	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	157
PID 6864 wrote to memory of 6872	6864	cmd.exe	159
PID 4716 wrote to memory of 7140	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	160
PID 7140 wrote to memory of 4500	7140	cmd.exe	162
PID 4716 wrote to memory of 3412	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	163
PID 3412 wrote to memory of 6948	3412	cmd.exe	165
PID 4716 wrote to memory of 4984	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	166
PID 4984 wrote to memory of 1964	4984	cmd.exe	168
PID 4716 wrote to memory of 1512	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	169
PID 1512 wrote to memory of 3772	1512	cmd.exe	171
PID 4716 wrote to memory of 3520	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	172
PID 3520 wrote to memory of 764	3520	cmd.exe	174
PID 4716 wrote to memory of 2044	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	175
PID 2044 wrote to memory of 6480	2044	cmd.exe	177
PID 4716 wrote to memory of 5516	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	178
PID 5516 wrote to memory of 1636	5516	cmd.exe	180
PID 4716 wrote to memory of 4364	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	181
PID 4364 wrote to memory of 2624	4364	cmd.exe	183
PID 4716 wrote to memory of 6584	4716	2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_210862b9b8f6e6132a6e575b3cf51309_akira_glassworm_ngrbot_quasar-rat.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeUpdate\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeUpdate\" /f
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyePayload\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyePayload\" /f
    3⤵
    PID:3212
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh winhttp reset proxy"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\system32\netsh.exe
    netsh winhttp reset proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6920
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f
    3⤵
    PID:4748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Clear-History
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4800
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil el"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AMSI/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AMSI/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AirSpaceChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AirSpaceChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:7036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Application\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Application\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowFilterGraph\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowFilterGraph\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowPluginControl\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowPluginControl\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Els_Hyphenation/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Els_Hyphenation/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"EndpointMapper\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"EndpointMapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"FirstUXPerf-Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"FirstUXPerf-Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"ForwardedEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"ForwardedEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"General Logging\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"General Logging\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"HardwareEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"HardwareEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"IHM_DebugChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"IHM_DebugChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-I2C/Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-I2C/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6872
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:7140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Internet Explorer\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Internet Explorer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Key Management Service\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Key Management Service\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_DshowReverseBridge\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_DshowReverseBridge\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceMFT\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceMFT\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceProxy\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationFrameServer\""
  2⤵
  PID:6584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationFrameServer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProc\""
  2⤵
  PID:4916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProc\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProcD3D\""
  2⤵
  PID:3896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProcD3D\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationAsyncWrapper\""
  2⤵
  - Executes a command shell one-liner
  PID:2156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationAsyncWrapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationContentProtection\""
  2⤵
  PID:6532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationContentProtection\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDS\""
  2⤵
  PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDS\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDeviceProxy\""
  2⤵
  PID:5896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMP4\""
  2⤵
  PID:3312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMP4\"
    3⤵
    PID:7044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMediaEngine\""
  2⤵
  PID:2052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMediaEngine\"
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformance\""
  2⤵
  PID:7020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformance\"
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformanceCore\""
  2⤵
  PID:2336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformanceCore\"
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPipeline\""
  2⤵
  PID:6312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPipeline\"
    3⤵
    PID:6348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPlatform\""
  2⤵
  PID:5448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPlatform\"
    3⤵
    PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationSrcPrefetch\""
  2⤵
  PID:6432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationSrcPrefetch\"
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\""
  2⤵
  PID:2180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\"
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Admin\""
  2⤵
  PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Admin\"
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Debug\""
  2⤵
  PID:4800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Debug\"
    3⤵
    PID:6696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Operational\""
  2⤵
  PID:6632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Operational\"
    3⤵
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\""
  2⤵
  PID:5988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\"
    3⤵
    PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\""
  2⤵
  PID:2888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Admin\""
  2⤵
  PID:2780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Admin\"
    3⤵
    PID:4640
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Debug\""
  2⤵
  PID:3236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Debug\"
    3⤵
    PID:1924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Diagnostic\""
  2⤵
  PID:6172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Diagnostic\"
    3⤵
    PID:1032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\""
  2⤵
  PID:2516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\"
    3⤵
    PID:7156
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\""
  2⤵
  PID:2604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\"
    3⤵
    - Clears Windows event logs
    PID:6676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\""
  2⤵
  PID:2676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\"
    3⤵
    PID:968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IE/Diagnostic\""
  2⤵
  PID:412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IE/Diagnostic\"
    3⤵
    PID:236
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IEFRAME/Diagnostic\""
  2⤵
  PID:5300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IEFRAME/Diagnostic\"
    3⤵
    PID:476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:6308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-OneCore-Setup/Analytic\""
  2⤵
  PID:6940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-OneCore-Setup/Analytic\"
    3⤵
    PID:6516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:6964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\""
  2⤵
  PID:2332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\"
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-System-Diagnostics-DiagnosticInvoker/Operational\""
  2⤵
  PID:6844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-System-Diagnostics-DiagnosticInvoker/Operational\"
    3⤵
    PID:5504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\""
  2⤵
  PID:4500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\"
    3⤵
    - Clears Windows event logs
    PID:2364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\""
  2⤵
  PID:6972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\"
    3⤵
    PID:5772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\""
  2⤵
  PID:3180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\"
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\""
  2⤵
  PID:1244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\"
    3⤵
    PID:5680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\""
  2⤵
  PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\"
    3⤵
    - Clears Windows event logs
    PID:6136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\""
  2⤵
  PID:620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\"
    3⤵
    PID:6196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\""
  2⤵
  PID:6424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\"
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\""
  2⤵
  PID:6284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\"
    3⤵
    PID:6636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\""
  2⤵
  PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\"
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\""
  2⤵
  PID:1756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Analytic\""
  2⤵
  PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Analytic\"
    3⤵
    PID:6324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Operational\""
  2⤵
  PID:6896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Operational\"
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ADSI/Debug\""
  2⤵
  PID:4816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ADSI/Debug\"
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ASN1/Operational\""
  2⤵
  PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ASN1/Operational\"
    3⤵
    PID:5664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/General\""
  2⤵
  PID:3004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/General\"
    3⤵
    PID:1164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\""
  2⤵
  PID:2692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\"
    3⤵
    PID:2768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AccelLib-AccelCx/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AccelLib-AccelCx/Operational\"
    3⤵
    PID:1316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\""
  2⤵
  PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\"
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\""
  2⤵
  PID:4656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\"
    3⤵
    PID:1600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Admin\""
  2⤵
  PID:4992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Admin\"
    3⤵
    - Clears Windows event logs
    PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\""
  2⤵
  PID:5188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\"
    3⤵
    PID:2444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\""
  2⤵
  PID:4460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\"
    3⤵
    PID:4140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Internal\""
  2⤵
  PID:1232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Internal\"
    3⤵
    - Clears Windows event logs
    PID:4944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppID/Operational\""
  2⤵
  PID:6696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppID/Operational\"
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\""
  2⤵
  PID:1852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\"
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\""
  2⤵
  PID:3152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\"
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\""
  2⤵
  PID:4844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\"
    3⤵
    PID:4244
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\""
  2⤵
  - Executes a command shell one-liner
  PID:7120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Verbose\""
  2⤵
  PID:5548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Verbose\"
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\""
  2⤵
  PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\"
    3⤵
    PID:6728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\""
  2⤵
  PID:5824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\"
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\""
  2⤵
  PID:6204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\"
    3⤵
    PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\""
  2⤵
  PID:6452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\"
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\""
  2⤵
  PID:2436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\"
    3⤵
    - Clears Windows event logs
    PID:1672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\""
  2⤵
  PID:5208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\""
  2⤵
  PID:5132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\"
    3⤵
    - Clears Windows event logs
    PID:4184
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\""
  2⤵
  PID:804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\"
    3⤵
    PID:5644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\""
  2⤵
  PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\"
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppSruProv\""
  2⤵
  PID:6852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppSruProv\"
    3⤵
    PID:6816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\""
  2⤵
  PID:2456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\"
    3⤵
    PID:2424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\""
  2⤵
  PID:5772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\"
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\""
  2⤵
  PID:3280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\"
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\""
  2⤵
  PID:5680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\"
    3⤵
    PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\""
  2⤵
  PID:6980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\"
    3⤵
    PID:6476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\""
  2⤵
  PID:6480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\"
    3⤵
    PID:6472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\""
  2⤵
  PID:1276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\"
    3⤵
    PID:6608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\""
  2⤵
  PID:6660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\"
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\""
  2⤵
  PID:3240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\"
    3⤵
    - Clears Windows event logs
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\""
  2⤵
  PID:7056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\"
    3⤵
    PID:5296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\""
  2⤵
  PID:4336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\""
  2⤵
  PID:4544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\"
    3⤵
    PID:4708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\""
  2⤵
  PID:2040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\"
    3⤵
    PID:6248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\""
  2⤵
  PID:6092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\"
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\""
  2⤵
  PID:4940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\""
  2⤵
  PID:3916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\""
  2⤵
  PID:944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\"
    3⤵
    PID:4764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\""
  2⤵
  PID:5816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\"
    3⤵
    PID:1136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\""
  2⤵
  PID:3720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\"
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\""
  2⤵
  PID:3884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\"
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\""
  2⤵
  PID:3632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\"
    3⤵
    PID:1988
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\""
  2⤵
  PID:3324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\"
    3⤵
    PID:4116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\""
  2⤵
  PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\"
    3⤵
    PID:5140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\""
  2⤵
  PID:2028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\"
    3⤵
    - Clears Windows event logs
    PID:1572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\""
  2⤵
  PID:3140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\"
    3⤵
    PID:3724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\"
    3⤵
    PID:4332
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\""
  2⤵
  PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\"
    3⤵
    PID:3792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\""
  2⤵
  PID:1248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\"
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\""
  2⤵
  PID:6228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\"
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\""
  2⤵
  PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\"
    3⤵
    PID:1728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Informational\""
  2⤵
  PID:5736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Informational\"
    3⤵
    PID:6168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Operational\""
  2⤵
  PID:3160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Operational\"
    3⤵
    PID:1408
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Performance\""
  2⤵
  PID:488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Performance\"
    3⤵
    PID:3168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\""
  2⤵
  PID:7096
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\"
    3⤵
    PID:6512
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audit/Analytic\""
  2⤵
  PID:5336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audit/Analytic\"
    3⤵
    PID:6680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\""
  2⤵
  PID:5744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\""
  2⤵
  PID:2596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\"
    3⤵
    PID:2860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\""
  2⤵
  PID:5504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\"
    3⤵
    PID:3332
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\""
  2⤵
  PID:5752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\"
    3⤵
    - Clears Windows event logs
    PID:2400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\""
  2⤵
  PID:2068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\"
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AxInstallService/Log\""
  2⤵
  PID:7104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AxInstallService/Log\"
    3⤵
    PID:4644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\""
  2⤵
  PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\"
    3⤵
    PID:4272
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\""
  2⤵
  PID:580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\"
    3⤵
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\""
  2⤵
  PID:4576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\"
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\""
  2⤵
  PID:6256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\""
  2⤵
  PID:6652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\"
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\""
  2⤵
  PID:5248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\"
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\""
  2⤵
  PID:4416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\"
    3⤵
    PID:3692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Backup\""
  2⤵
  PID:5028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Backup\"
    3⤵
    PID:3416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\""
  2⤵
  PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\"
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\""
  2⤵
  PID:1984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\"
    3⤵
    PID:1004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\""
  2⤵
  PID:5632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\""
  2⤵
  PID:4540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Operational\""
  2⤵
  PID:4532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Operational\"
    3⤵
    PID:6360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\""
  2⤵
  PID:4516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\"
    3⤵
    PID:6924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\""
  2⤵
  PID:4380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\"
    3⤵
    PID:3808
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\""
  2⤵
  PID:5176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6720
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\""
  2⤵
  PID:3256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\"
    3⤵
    PID:2644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\"
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\""
  2⤵
  PID:4308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\"
    3⤵
    PID:6916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\""
  2⤵
  PID:4440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\""
  2⤵
  PID:5436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\"
    3⤵
    PID:7068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\""
  2⤵
  PID:6268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\"
    3⤵
    PID:5452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\""
  2⤵
  PID:6988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\"
    3⤵
    PID:2836
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\""
  2⤵
  PID:6336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\"
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\""
  2⤵
  PID:7108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCache/Operational\""
  2⤵
  PID:5728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCache/Operational\"
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:4328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\"
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\""
  2⤵
  PID:364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\"
    3⤵
    PID:6344
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\""
  2⤵
  PID:4400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\"
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\""
  2⤵
  PID:6680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\"
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\""
  2⤵
  PID:800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\""
  2⤵
  PID:6848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\"
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Operational\""
  2⤵
  PID:6856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Operational\"
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CDROM/Operational\""
  2⤵
  PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CDROM/Operational\"
    3⤵
    PID:7152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:6384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Analytic\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\""
  2⤵
  PID:360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\"
    3⤵
    PID:3448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\""
  2⤵
  PID:3700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\"
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Call\""
  2⤵
  PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Call\"
    3⤵
    PID:6960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/CreateInstance\""
  2⤵
  PID:6904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/CreateInstance\"
    3⤵
    PID:5804
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\""
  2⤵
  PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\"
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\""
  2⤵
  PID:1124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\"
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\""
  2⤵
  PID:6984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\"
    3⤵
    PID:2724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\""
  2⤵
  PID:2924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\"
    3⤵
    PID:1388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\""
  2⤵
  PID:1968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\"
    3⤵
    PID:1164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\""
  2⤵
  PID:3308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\"
    3⤵
    PID:4384
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Calculator/Debug\""
  2⤵
  PID:6040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Calculator/Debug\"
    3⤵
    PID:3704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Calculator/Diagnostic\""
  2⤵
  PID:4660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Calculator/Diagnostic\"
    3⤵
    PID:1136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\"
    3⤵
    PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\""
  2⤵
  PID:2448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\"
    3⤵
    PID:6720
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\""
  2⤵
  PID:4772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\"
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\""
  2⤵
  PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\"
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\""
  2⤵
  PID:5948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\"
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\""
  2⤵
  PID:1148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\"
    3⤵
    PID:728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Debug\""
  2⤵
  PID:1872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Debug\"
    3⤵
    PID:1884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Operational\""
  2⤵
  PID:1156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Operational\"
    3⤵
    PID:6388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudRestoreLauncher/Operational\""
  2⤵
  PID:4692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudRestoreLauncher/Operational\"
    3⤵
    PID:2836
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Debug\""
  2⤵
  PID:1220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Debug\"
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Initialization\""
  2⤵
  PID:6200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Initialization\"
    3⤵
    PID:6868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Operational\""
  2⤵
  PID:6676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Operational\"
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\""
  2⤵
  PID:252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\"
    3⤵
    PID:3168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\""
  2⤵
  PID:1672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\"
    3⤵
    - Clears Windows event logs
    PID:3816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\""
  2⤵
  PID:2948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\"
    3⤵
    PID:6944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\""
  2⤵
  PID:2392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\"
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\""
  2⤵
  PID:2664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\"
    3⤵
    PID:2640
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\""
  2⤵
  PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\""
  2⤵
  PID:5672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\"
    3⤵
    PID:3544
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\""
  2⤵
  PID:6136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\""
  2⤵
  PID:3556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\"
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\""
  2⤵
  PID:3396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\"
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\""
  2⤵
  PID:5804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\"
    3⤵
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\""
  2⤵
  PID:3892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\"
    3⤵
    PID:6060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\""
  2⤵
  PID:3860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\"
    3⤵
    PID:2756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\""
  2⤵
  PID:5716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\"
    3⤵
    PID:4964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\""
  2⤵
  PID:4708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\"
    3⤵
    PID:2916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\""
  2⤵
  PID:4980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\"
    3⤵
    PID:5832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\""
  2⤵
  PID:4868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\"
    3⤵
    PID:6508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\""
  2⤵
  PID:3304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Analytic\""
  2⤵
  PID:4260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Analytic\"
    3⤵
    PID:3212
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Operational\""
  2⤵
  PID:564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Operational\"
    3⤵
    PID:1304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\""
  2⤵
  PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\"
    3⤵
    PID:6056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\""
  2⤵
  PID:6080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\"
    3⤵
    PID:2100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\""
  2⤵
  PID:4212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\"
    3⤵
    PID:5140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\""
  2⤵
  PID:728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\"
    3⤵
    - Clears Windows event logs
    PID:2524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\""
  2⤵
  PID:2164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\""
  2⤵
  PID:6388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\""
  2⤵
  PID:2892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\"
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/CertInUse\""
  2⤵
  PID:3792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/CertInUse\"
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/KeyMgmt\""
  2⤵
  PID:2024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/KeyMgmt\"
    3⤵
    PID:5124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\""
  2⤵
  PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\"
    3⤵
    PID:248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\""
  2⤵
  PID:264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\"
    3⤵
    PID:6304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\""
  2⤵
  PID:6272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\"
    3⤵
    PID:6892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\""
  2⤵
  PID:5024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\"
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\""
  2⤵
  PID:5264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\"
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\""
  2⤵
  PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\"
    3⤵
    PID:6816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\""
  2⤵
  PID:5080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\"
    3⤵
    PID:3164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DCLocator/Debug\""
  2⤵
  PID:1980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DCLocator/Debug\"
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\""
  2⤵
  PID:4488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\"
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Logging\""
  2⤵
  PID:7160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Logging\"
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\""
  2⤵
  PID:1332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\"
    3⤵
    PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\""
  2⤵
  PID:1344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\"
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Admin\""
  2⤵
  PID:3148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Admin\"
    3⤵
    PID:3692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Analytic\""
  2⤵
  PID:2264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Analytic\"
    3⤵
    PID:2756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Debug\""
  2⤵
  PID:6252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Debug\"
    3⤵
    PID:4964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Operational\""
  2⤵
  PID:4340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Operational\"
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\""
  2⤵
  PID:1164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\"
    3⤵
    PID:880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\""
  2⤵
  PID:2768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\"
    3⤵
    PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Analytic\""
  2⤵
  PID:3704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Analytic\"
    3⤵
    PID:6036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Logging\""
  2⤵
  PID:5048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Logging\"
    3⤵
    PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXP/Analytic\""
  2⤵
  PID:3176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXP/Analytic\"
    3⤵
    PID:3532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\""
  2⤵
  PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\"
    3⤵
    PID:1116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\""
  2⤵
  PID:1988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\"
    3⤵
    PID:628
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\""
  2⤵
  PID:1948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\"
    3⤵
    PID:860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\""
  2⤵
  PID:4696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\"
    3⤵
    PID:6156
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\""
  2⤵
  PID:6684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\"
    3⤵
    PID:3724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\""
  2⤵
  PID:2836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\"
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:6732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\"
    3⤵
    PID:5284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Operational\""
  2⤵
  PID:6004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Operational\"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Performance\""
  2⤵
  PID:5124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Performance\"
    3⤵
    PID:3512
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\""
  2⤵
  PID:1780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\"
    3⤵
    PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\""
  2⤵
  PID:584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\""
  2⤵
  PID:5512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\"
    3⤵
    PID:1484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\""
  2⤵
  PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\"
    3⤵
    PID:2308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\""
  2⤵
  PID:1104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\"
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\""
  2⤵
  PID:6412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\"
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:5700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\"
    3⤵
    PID:1400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\""
  2⤵
  PID:5072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\"
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\""
  2⤵
  PID:2500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\"
    3⤵
    PID:1444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot\""
  2⤵
  PID:4872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot\"
    3⤵
    PID:2284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\""
  2⤵
  PID:1424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\"
    3⤵
    PID:3204
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\""
  2⤵
  PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\""
  2⤵
  PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\"
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\""
  2⤵
  PID:3980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\"
    3⤵
    PID:6460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\""
  2⤵
  PID:2724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\"
    3⤵
    PID:5612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\"
    3⤵
    PID:5628
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\""
  2⤵
  PID:1004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\"
    3⤵
    PID:4840
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\""
  2⤵
  PID:6340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\"
    3⤵
    PID:704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\""
  2⤵
  PID:1240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\"
    3⤵
    PID:6348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\""
  2⤵
  - Executes a command shell one-liner
  PID:3648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\"
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\""
  2⤵
  PID:6288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\"
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\""
  2⤵
  PID:628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\"
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Query/Performance\""
  2⤵
  PID:860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Query/Performance\"
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\""
  2⤵
  PID:6596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\"
    3⤵
    - Clears Windows event logs
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\""
  2⤵
  PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\"
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\""
  2⤵
  PID:1032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\"
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\""
  2⤵
  PID:6812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\""
  2⤵
  PID:5332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\""
  2⤵
  PID:6168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\"
    3⤵
    PID:916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\""
  2⤵
  PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\""
  2⤵
  PID:4880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\""
  2⤵
  PID:6420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\"
    3⤵
    PID:4352
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\""
  2⤵
  PID:6964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\"
    3⤵
    PID:5768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\""
  2⤵
  PID:4632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\"
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\""
  2⤵
  PID:3948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\"
    3⤵
    PID:3560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\""
  2⤵
  PID:6580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\"
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\""
  2⤵
  PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\"
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\""
  2⤵
  PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\"
    3⤵
    PID:4232
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\""
  2⤵
  PID:5968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\"
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\""
  2⤵
  PID:6060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\"
    3⤵
    - Clears Windows event logs
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\""
  2⤵
  PID:5296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\"
    3⤵
    PID:3692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\""
  2⤵
  PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\"
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\""
  2⤵
  PID:2916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\"
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\""
  2⤵
  PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\"
    3⤵
    PID:492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\""
  2⤵
  PID:6484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\"
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\""
  2⤵
  PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\""
  2⤵
  PID:6880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\"
    3⤵
    PID:2404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\""
  2⤵
  PID:1792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\"
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\""
  2⤵
  PID:7100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\""
  2⤵
  PID:2964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:1708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\""
  2⤵
  PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\"
    3⤵
    PID:6448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\""
  2⤵
  PID:1840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\"
    3⤵
    PID:4628
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\""
  2⤵
  PID:6184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\"
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\""
  2⤵
  PID:4968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\"
    3⤵
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\""
  2⤵
  PID:6868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\""
  2⤵
  PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\"
    3⤵
    PID:5864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\""
  2⤵
  PID:5384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\"
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\""
  2⤵
  PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\"
    3⤵
    PID:4184
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\""
  2⤵
  PID:2308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\"
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\""
  2⤵
  PID:6504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\"
    3⤵
    - Clears Windows event logs
    PID:6492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\""
  2⤵
  PID:5172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\"
    3⤵
    PID:4644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\""
  2⤵
  PID:2608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\"
    3⤵
    PID:6476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\""
  2⤵
  PID:6140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\"
    3⤵
    PID:6196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\""
  2⤵
  PID:2632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:2624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\""
  2⤵
  PID:6636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\""
  2⤵
  - Executes a command shell one-liner
  PID:5696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\"
    3⤵
    PID:3692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectSound/Debug\""
  2⤵
  PID:940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectSound/Debug\"
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Disk/Operational\""
  2⤵
  PID:1096
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Disk/Operational\"
    3⤵
    PID:6112
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\"
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\""
  2⤵
  PID:2932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\"
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\""
  2⤵
  PID:1064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:6648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\""
  2⤵
  PID:1804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\"
    3⤵
    PID:6180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\""
  2⤵
  PID:6056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\"
    3⤵
    PID:1616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\""
  2⤵
  PID:4108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\"
    3⤵
    PID:5084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\""
  2⤵
  PID:7068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\"
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\""
  2⤵
  PID:6108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4628
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\""
  2⤵
  PID:3188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\"
    3⤵
    PID:6592
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Documents/Performance\""
  2⤵
  PID:3136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Documents/Performance\"
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\""
  2⤵
  PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\"
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverProxy/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:3168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverProxy/Operational\"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverProxy/Performance\""
  2⤵
  PID:124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverProxy/Performance\"
    3⤵
    PID:6560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\""
  2⤵
  PID:2720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\"
    3⤵
    PID:2860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Compositor/Diagnostic\""
  2⤵
  PID:4588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Compositor/Diagnostic\"
    3⤵
    PID:6492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\""
  2⤵
  PID:5592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\"
    3⤵
    PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\""
  2⤵
  PID:5788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\"
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\""
  2⤵
  PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\"
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\""
  2⤵
  PID:1076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\"
    3⤵
    PID:4464
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\""
  2⤵
  PID:7132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\"
    3⤵
    PID:2268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\""
  2⤵
  PID:5212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\"
    3⤵
    PID:3244
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Debug\""
  2⤵
  PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Debug\"
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Performance\""
  2⤵
  PID:3416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Performance\"
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\""
  2⤵
  PID:1092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\"
    3⤵
    PID:5832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\""
  2⤵
  PID:3620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\"
    3⤵
    PID:5664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\""
  2⤵
  PID:6708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\"
    3⤵
    PID:2352
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\""
  2⤵
  PID:3820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\"
    3⤵
    PID:3744
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\""
  2⤵
  PID:1600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\"
    3⤵
    PID:7008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\""
  2⤵
  PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\"
    3⤵
    PID:2968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\""
  2⤵
  PID:5732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\"
    3⤵
    PID:1436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\""
  2⤵
  PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Debug\"
    3⤵
    PID:2248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Operational\""
  2⤵
  PID:5056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Operational\"
    3⤵
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\""
  2⤵
  PID:3676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/Operational\""
  2⤵
  PID:1408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/Operational\"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Analytic\""
  2⤵
  PID:6840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Analytic\"
    3⤵
    PID:976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:6304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Debug\"
    3⤵
    PID:7148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Operational\""
  2⤵
  PID:2860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Operational\"
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:6492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\"
    3⤵
    PID:5792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\""
  2⤵
  PID:3560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\"
    3⤵
    PID:2580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\""
  2⤵
  PID:5800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\"
    3⤵
    PID:1560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\""
  2⤵
  PID:1692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\"
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\""
  2⤵
  PID:5464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\"
    3⤵
    PID:2088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\""
  2⤵
  PID:5152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\"
    3⤵
    PID:6176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\""
  2⤵
  PID:3132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\"
    3⤵
    PID:1180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorClass/Operational\""
  2⤵
  PID:3028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorClass/Operational\"
    3⤵
    PID:1356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\""
  2⤵
  PID:6460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\"
    3⤵
    PID:880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Debug\""
  2⤵
  PID:6280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Debug\"
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Operational\""
  2⤵
  PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Operational\"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\""
  2⤵
  PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\"
    3⤵
    PID:6428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Analytic\""
  2⤵
  PID:6648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Debug\""
  2⤵
  PID:4560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Analytic\""
  2⤵
  PID:3880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Analytic\"
    3⤵
    PID:3108
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Debug\""
  2⤵
  PID:5084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Debug\"
    3⤵
    PID:6448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Operational\""
  2⤵
  PID:1744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Operational\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\""
  2⤵
  PID:1008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\"
    3⤵
    PID:6332
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Operational\""
  2⤵
  PID:6736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Operational\"
    3⤵
    PID:3344
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\""
  2⤵
  PID:3376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\"
    3⤵
    PID:4932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\""
  2⤵
  PID:4620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\"
    3⤵
    PID:476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\""
  2⤵
  PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\"
    3⤵
    PID:3052
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Feedback-Service-TriggerProvider\""
  2⤵
  PID:6816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Feedback-Service-TriggerProvider\"
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\""
  2⤵
  PID:6876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\"
    3⤵
    PID:3540
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\""
  2⤵
  PID:2580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\"
    3⤵
    PID:764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\""
  2⤵
  PID:2288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\"
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\"
    3⤵
    PID:6608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\""
  2⤵
  PID:2912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\""
  2⤵
  PID:3244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\"
    3⤵
    PID:3032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\""
  2⤵
  PID:3528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\"
    3⤵
    PID:5348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\""
  2⤵
  PID:2812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\"
    3⤵
    PID:4160
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\""
  2⤵
  PID:5832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\""
  2⤵
  PID:3740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\"
    3⤵
    PID:5976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\"
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\""
  2⤵
  PID:6428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\"
    3⤵
    PID:7024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\""
  2⤵
  PID:2644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\"
    3⤵
    PID:2968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\""
  2⤵
  PID:3048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\"
    3⤵
    PID:3108
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\""
  2⤵
  PID:1544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\"
    3⤵
    PID:6540
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\""
  2⤵
  PID:4188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\""
  2⤵
  PID:3724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\"
    3⤵
    PID:7164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\""
  2⤵
  PID:2572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\"
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\""
  2⤵
  PID:5864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\"
    3⤵
    - Clears Windows event logs
    PID:236
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Debug\""
  2⤵
  PID:6352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Debug\"
    3⤵
    PID:6104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Operational\""
  2⤵
  PID:108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6344
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\""
  2⤵
  PID:6832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\"
    3⤵
    PID:5596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\""
  2⤵
  PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\"
    3⤵
    PID:5812
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\""
  2⤵
  PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\"
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HAL/Debug\""
  2⤵
  PID:2636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HAL/Debug\"
    3⤵
    PID:6476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\""
  2⤵
  PID:6472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\"
    3⤵
    PID:4920
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\""
  2⤵
  PID:6176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\"
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\""
  2⤵
  PID:3032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\"
    3⤵
    - Clears Windows event logs
    PID:5780
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Debug\""
  2⤵
  PID:5624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Debug\"
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\""
  2⤵
  PID:6112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Help/Operational\""
  2⤵
  PID:4756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Help/Operational\"
    3⤵
    PID:6012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\""
  2⤵
  PID:4384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\"
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\""
  2⤵
  PID:4600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\"
    3⤵
    PID:2404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\""
  2⤵
  PID:4136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\"
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\""
  2⤵
  PID:4204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\"
    3⤵
    PID:1708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Log\""
  2⤵
  PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Log\"
    3⤵
    PID:1116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Trace\""
  2⤵
  PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Trace\"
    3⤵
    PID:7076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\""
  2⤵
  PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\""
  2⤵
  PID:1044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:3196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\"
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\""
  2⤵
  PID:476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\"
    3⤵
    PID:6356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\""
  2⤵
  PID:6308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\"
    3⤵
    PID:3816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\""
  2⤵
  PID:1132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\"
    3⤵
    PID:7048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:5492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\""
  2⤵
  PID:6364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\"
    3⤵
    PID:5688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-KMCL-Child/Analytic\""
  2⤵
  PID:1392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-KMCL-Child/Analytic\"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\""
  2⤵
  PID:6544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\""
  2⤵
  PID:6976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\"
    3⤵
    PID:2764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\""
  2⤵
  PID:4160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\"
    3⤵
    PID:1308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IE-SmartScreen\""
  2⤵
  - Executes a command shell one-liner
  PID:2928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IE-SmartScreen\"
    3⤵
    - Clears Windows event logs
    PID:3252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKE/Operational\""
  2⤵
  PID:3212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKE/Operational\"
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\""
  2⤵
  PID:2352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\"
    3⤵
    PID:6036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\""
  2⤵
  PID:2404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\"
    3⤵
    PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\""
  2⤵
  PID:5956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\"
    3⤵
    PID:1620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\""
  2⤵
  PID:5724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\"
    3⤵
    PID:3688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\""
  2⤵
  PID:2216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\"
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\""
  2⤵
  PID:2084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\""
  2⤵
  PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\"
    3⤵
    PID:6556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\""
  2⤵
  PID:1604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\"
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\""
  2⤵
  PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\"
    3⤵
    PID:2852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\""
  2⤵
  PID:5852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\"
    3⤵
    PID:3816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\""
  2⤵
  PID:6892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\""
  2⤵
  PID:2640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\"
    3⤵
    PID:4404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\""
  2⤵
  PID:3164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\"
    3⤵
    PID:1912
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\""
  2⤵
  PID:6476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\"
    3⤵
    PID:2004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\""
  2⤵
  PID:2536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\"
    3⤵
    PID:2300
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\""
  2⤵
  PID:2312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\"
    3⤵
    PID:2832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\""
  2⤵
  PID:2620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\"
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\""
  2⤵
  PID:4784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\"
    3⤵
    PID:6508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:3252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\"
    3⤵
    PID:5976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\""
  2⤵
  PID:5484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\"
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\""
  2⤵
  PID:7008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:7084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\""
  2⤵
  PID:2704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\"
    3⤵
    PID:6724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\""
  2⤵
  PID:1116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\"
    3⤵
    PID:7036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:6592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\""
  2⤵
  PID:6332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:3512
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\""
  2⤵
  PID:6556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\"
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\""
  2⤵
  PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\"
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\""
  2⤵
  PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\""
  2⤵
  PID:968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\"
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\""
  2⤵
  PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\"
    3⤵
    PID:5444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational\""
  2⤵
  PID:4956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational\"
    3⤵
    PID:1444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance\""
  2⤵
  PID:2856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance\"
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos/Operational\""
  2⤵
  PID:1964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos/Operational\"
    3⤵
    PID:5660
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\""
  2⤵
  PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\"
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\""
  2⤵
  PID:4280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\"
    3⤵
    PID:4928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\""
  2⤵
  PID:3692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\"
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\""
  2⤵
  PID:1712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\"
    3⤵
    PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\""
  2⤵
  PID:4952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\"
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\""
  2⤵
  PID:3736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\"
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\"
    3⤵
    PID:5140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\""
  2⤵
  PID:5684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\"
    3⤵
    PID:2248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-CPU-Partition/Analytic\""
  2⤵
  PID:1928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-CPU-Partition/Analytic\"
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-CPU-Starvation/Operational\""
  2⤵
  PID:7028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-CPU-Starvation/Operational\"
    3⤵
    PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Cache/Operational\""
  2⤵
  PID:6560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Cache/Operational\"
    3⤵
    PID:2208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\""
  2⤵
  PID:5556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\"
    3⤵
    PID:5596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Dump/Operational\""
  2⤵
  PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Dump/Operational\"
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:5812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\"
    3⤵
    PID:3544
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\""
  2⤵
  PID:6620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\"
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\""
  2⤵
  PID:2088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\"
    3⤵
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\""
  2⤵
  PID:5008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\""
  2⤵
  PID:1356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:5612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\""
  2⤵
  PID:2356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\"
    3⤵
    PID:7044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\""
  2⤵
  PID:4448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\"
    3⤵
    PID:1976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\""
  2⤵
  PID:6024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\"
    3⤵
    PID:4116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\""
  2⤵
  PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PRM/Operational\""
  2⤵
  PID:7036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PRM/Operational\"
    3⤵
    PID:6624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\""
  2⤵
  PID:5460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\"
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\""
  2⤵
  PID:1924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\"
    3⤵
    PID:1520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Boot Diagnostic\""
  2⤵
  PID:3552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Boot Diagnostic\"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration\""
  2⤵
  PID:5160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration\"
    3⤵
    PID:976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:1736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration Diagnostic\"
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:4888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic\"
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Management\""
  2⤵
  PID:1560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Management\"
    3⤵
    PID:1636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Diagnostic\""
  2⤵
  PID:5796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Diagnostic\"
    3⤵
    PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

goodbye.log

Path C:\Windows\Temp\goodbye.log
Size 2KB
SHA256 1ca0554cf39010453290c60bac2a0d0edcbc473964843ff1d9a98e37738ea4c4
MD5 564ce3e2164675d7d6f88529c65b1f78
SHA1 ecbbccd73a95433cbc0b14a8b874bc9d28fde5db
SHA512 36683759610991e0f9dd1a89b4e9482984fe4836460114a4353625b5afe3d87883213b0ac4663b709f0949b2ad6233e2cb32d329f6906ba168d2afdc1044e876
TLSH
T168519DB038E937A20FF25422701CDA1C931C63FBEAF54B96F1ED29402F98E1095915F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4716-17-0x00007FF787FE0000-0x00007FF788785000-memory.dmp

Download

memory/4716-30-0x00007FF787FE0000-0x00007FF788785000-memory.dmp

Download

memory/4800-15-0x000001F3E9080000-0x000001F3E90A2000-memory.dmp

Download