b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057

Analysis

max time kernel
142s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 17:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe
Size 5.1MB
Sample260819-v8b7rage83
SHA256 b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057
MD5 240ef6c0db8bf4352f16ea1f3b398f65
SHA1 78ca3657c8dc507ea8abfcab9c1aeb44b9fef577
SHA512 9351e0be0a55f4043c89c9abd6bf71b327d51f17f18599db195ba25428f7e79a79de5bfb963f96d5b1d232c982ea965858050bb5a75d4485dd7c400eadd2c91e
SSDEEP 49152:mcsdMbEIVyhuB51+bDqcUVMWMcYS4RvoKByHTbLiKnvpeyxW9UitztzjiTqf1q7H:m1envMBcYSuRgoe9q+Xf
TLSH
T10A466D03E2A581E9C06EC478835BA733FA32B88D0534B65B5BD4DB212F65F50AF0E759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/4108-18-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp	disable_win_def
behavioral2/memory/4108-22-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp	disable_win_def
behavioral2/memory/4108-31-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp	disable_win_def

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1140	wevtutil.exe
1176	wevtutil.exe
3140	wevtutil.exe
5840	wevtutil.exe
1044	Process not Found
3436	wevtutil.exe
2812	wevtutil.exe
624	wevtutil.exe
5392	wevtutil.exe
3652	Process not Found
4580	wevtutil.exe
5400	wevtutil.exe
5828	wevtutil.exe
3652	wevtutil.exe
6012	wevtutil.exe
3040	Process not Found
4524	Process not Found
4524	Process not Found
1004	wevtutil.exe
480	wevtutil.exe
1140	wevtutil.exe
3104	wevtutil.exe
3688	wevtutil.exe
2768	wevtutil.exe
5828	wevtutil.exe
3436	wevtutil.exe
2040	wevtutil.exe
5248	wevtutil.exe
6120	wevtutil.exe
3940	Process not Found
2480	wevtutil.exe
1196	wevtutil.exe
6100	wevtutil.exe
1888	wevtutil.exe
5344	wevtutil.exe
2712	wevtutil.exe
1028	wevtutil.exe
480	wevtutil.exe
1200	wevtutil.exe
4236	wevtutil.exe
3088	wevtutil.exe
2604	wevtutil.exe
5788	Process not Found
1028	Process not Found
1968	wevtutil.exe
2764	wevtutil.exe
3076	wevtutil.exe
4524	wevtutil.exe
1888	wevtutil.exe
1508	wevtutil.exe
4924	wevtutil.exe
2604	wevtutil.exe
864	wevtutil.exe
6116	wevtutil.exe
1200	wevtutil.exe
2432	wevtutil.exe
3680	wevtutil.exe
4912	wevtutil.exe
4176	wevtutil.exe
1684	wevtutil.exe
5624	wevtutil.exe
924	wevtutil.exe
6072	wevtutil.exe
3140	wevtutil.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5448	cmd.exe
3360	cmd.exe
728	cmd.exe
2860	cmd.exe

Detect suspicious telegram bot 3 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/memory/4108-18-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4108-22-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/4108-31-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp	suspicious_telegram_bot

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2840	cmd.exe
2608	cmd.exe
2944	Process not Found
3080	cmd.exe
724	cmd.exe
2976	cmd.exe
5652	cmd.exe
2060	cmd.exe
4588	cmd.exe
5008	cmd.exe
5632	Process not Found
2284	cmd.exe
4836	Process not Found
3340	cmd.exe
624	cmd.exe
2988	cmd.exe
3528	cmd.exe
4608	cmd.exe
2148	cmd.exe
3136	cmd.exe
3772	Process not Found
4156	cmd.exe
5360	cmd.exe
2960	cmd.exe
4732	cmd.exe
1944	cmd.exe
4444	cmd.exe
2880	cmd.exe
5508	cmd.exe
2016	cmd.exe
4580	cmd.exe
4832	cmd.exe
2144	cmd.exe
1496	Process not Found
6020	cmd.exe
2564	cmd.exe
4436	cmd.exe
6056	cmd.exe
3088	cmd.exe
2028	cmd.exe
3004	cmd.exe
1788	cmd.exe
4300	cmd.exe
4224	cmd.exe
5344	cmd.exe
5052	cmd.exe
1856	cmd.exe
2436	cmd.exe
1900	cmd.exe
3012	cmd.exe
1344	cmd.exe
5796	cmd.exe
944	cmd.exe
1312	cmd.exe
1332	cmd.exe
4932	cmd.exe
2616	cmd.exe
1992	cmd.exe
5628	cmd.exe
2440	cmd.exe
4624	cmd.exe
1244	cmd.exe
2872	cmd.exe
3392	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4832	powershell.exe
4832	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeSecurityPrivilege	5100	wevtutil.exe
Token: SeBackupPrivilege	5100	wevtutil.exe
Token: SeSecurityPrivilege	5612	wevtutil.exe
Token: SeBackupPrivilege	5612	wevtutil.exe
Token: SeSecurityPrivilege	1316	wevtutil.exe
Token: SeBackupPrivilege	1316	wevtutil.exe
Token: SeSecurityPrivilege	4372	wevtutil.exe
Token: SeBackupPrivilege	4372	wevtutil.exe
Token: SeSecurityPrivilege	2052	wevtutil.exe
Token: SeBackupPrivilege	2052	wevtutil.exe
Token: SeSecurityPrivilege	3704	wevtutil.exe
Token: SeBackupPrivilege	3704	wevtutil.exe
Token: SeSecurityPrivilege	4056	wevtutil.exe
Token: SeBackupPrivilege	4056	wevtutil.exe
Token: SeSecurityPrivilege	4156	wevtutil.exe
Token: SeBackupPrivilege	4156	wevtutil.exe
Token: SeSecurityPrivilege	2520	wevtutil.exe
Token: SeBackupPrivilege	2520	wevtutil.exe
Token: SeSecurityPrivilege	3172	wevtutil.exe
Token: SeBackupPrivilege	3172	wevtutil.exe
Token: SeSecurityPrivilege	4572	wevtutil.exe
Token: SeBackupPrivilege	4572	wevtutil.exe
Token: SeSecurityPrivilege	3784	wevtutil.exe
Token: SeBackupPrivilege	3784	wevtutil.exe
Token: SeSecurityPrivilege	1900	wevtutil.exe
Token: SeBackupPrivilege	1900	wevtutil.exe
Token: SeSecurityPrivilege	2104	wevtutil.exe
Token: SeBackupPrivilege	2104	wevtutil.exe
Token: SeSecurityPrivilege	4316	wevtutil.exe
Token: SeBackupPrivilege	4316	wevtutil.exe
Token: SeSecurityPrivilege	5192	wevtutil.exe
Token: SeBackupPrivilege	5192	wevtutil.exe
Token: SeSecurityPrivilege	4168	wevtutil.exe
Token: SeBackupPrivilege	4168	wevtutil.exe
Token: SeSecurityPrivilege	4380	wevtutil.exe
Token: SeBackupPrivilege	4380	wevtutil.exe
Token: SeSecurityPrivilege	3416	wevtutil.exe
Token: SeBackupPrivilege	3416	wevtutil.exe
Token: SeSecurityPrivilege	2268	wevtutil.exe
Token: SeBackupPrivilege	2268	wevtutil.exe
Token: SeSecurityPrivilege	6116	wevtutil.exe
Token: SeBackupPrivilege	6116	wevtutil.exe
Token: SeSecurityPrivilege	1968	wevtutil.exe
Token: SeBackupPrivilege	1968	wevtutil.exe
Token: SeSecurityPrivilege	2852	wevtutil.exe
Token: SeBackupPrivilege	2852	wevtutil.exe
Token: SeSecurityPrivilege	2316	wevtutil.exe
Token: SeBackupPrivilege	2316	wevtutil.exe
Token: SeSecurityPrivilege	4224	wevtutil.exe
Token: SeBackupPrivilege	4224	wevtutil.exe
Token: SeSecurityPrivilege	1360	wevtutil.exe
Token: SeBackupPrivilege	1360	wevtutil.exe
Token: SeSecurityPrivilege	2736	wevtutil.exe
Token: SeBackupPrivilege	2736	wevtutil.exe
Token: SeSecurityPrivilege	4084	wevtutil.exe
Token: SeBackupPrivilege	4084	wevtutil.exe
Token: SeSecurityPrivilege	3320	wevtutil.exe
Token: SeBackupPrivilege	3320	wevtutil.exe
Token: SeSecurityPrivilege	1508	wevtutil.exe
Token: SeBackupPrivilege	1508	wevtutil.exe
Token: SeSecurityPrivilege	4296	wevtutil.exe
Token: SeBackupPrivilege	4296	wevtutil.exe
Token: SeSecurityPrivilege	4176	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5448	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	89
PID 5448 wrote to memory of 4948	5448	cmd.exe	91
PID 4108 wrote to memory of 3360	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	92
PID 3360 wrote to memory of 1632	3360	cmd.exe	94
PID 4108 wrote to memory of 728	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	95
PID 728 wrote to memory of 1220	728	cmd.exe	97
PID 4108 wrote to memory of 2860	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	98
PID 2860 wrote to memory of 4136	2860	cmd.exe	100
PID 4108 wrote to memory of 4668	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	101
PID 4668 wrote to memory of 3832	4668	cmd.exe	103
PID 4108 wrote to memory of 436	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	104
PID 436 wrote to memory of 6072	436	cmd.exe	106
PID 4108 wrote to memory of 4832	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	107
PID 4108 wrote to memory of 2972	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	109
PID 2972 wrote to memory of 5100	2972	cmd.exe	111
PID 4108 wrote to memory of 1576	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	112
PID 1576 wrote to memory of 5612	1576	cmd.exe	114
PID 4108 wrote to memory of 1280	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	115
PID 1280 wrote to memory of 1316	1280	cmd.exe	117
PID 4108 wrote to memory of 1120	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	118
PID 1120 wrote to memory of 4372	1120	cmd.exe	120
PID 4108 wrote to memory of 2840	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	121
PID 2840 wrote to memory of 2052	2840	cmd.exe	123
PID 4108 wrote to memory of 5244	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	124
PID 5244 wrote to memory of 3704	5244	cmd.exe	126
PID 4108 wrote to memory of 1592	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	127
PID 1592 wrote to memory of 4056	1592	cmd.exe	129
PID 4108 wrote to memory of 3504	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	130
PID 3504 wrote to memory of 4156	3504	cmd.exe	132
PID 4108 wrote to memory of 5464	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	133
PID 5464 wrote to memory of 2520	5464	cmd.exe	135
PID 4108 wrote to memory of 2060	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	136
PID 2060 wrote to memory of 3172	2060	cmd.exe	138
PID 4108 wrote to memory of 3796	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	139
PID 3796 wrote to memory of 4572	3796	cmd.exe	141
PID 4108 wrote to memory of 4232	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	142
PID 4232 wrote to memory of 3784	4232	cmd.exe	144
PID 4108 wrote to memory of 1480	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	145
PID 1480 wrote to memory of 1900	1480	cmd.exe	147
PID 4108 wrote to memory of 5000	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	148
PID 5000 wrote to memory of 2104	5000	cmd.exe	150
PID 4108 wrote to memory of 5268	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	151
PID 5268 wrote to memory of 4316	5268	cmd.exe	153
PID 4108 wrote to memory of 5408	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	154
PID 5408 wrote to memory of 5192	5408	cmd.exe	156
PID 4108 wrote to memory of 3376	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	157
PID 3376 wrote to memory of 4168	3376	cmd.exe	159
PID 4108 wrote to memory of 4640	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	160
PID 4640 wrote to memory of 4380	4640	cmd.exe	162
PID 4108 wrote to memory of 4932	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	163
PID 4932 wrote to memory of 3416	4932	cmd.exe	165
PID 4108 wrote to memory of 5352	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	166
PID 5352 wrote to memory of 2268	5352	cmd.exe	168
PID 4108 wrote to memory of 3804	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	169
PID 3804 wrote to memory of 6116	3804	cmd.exe	171
PID 4108 wrote to memory of 5636	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	172
PID 5636 wrote to memory of 1968	5636	cmd.exe	174
PID 4108 wrote to memory of 2328	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	175
PID 2328 wrote to memory of 2852	2328	cmd.exe	177
PID 4108 wrote to memory of 2512	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	178
PID 2512 wrote to memory of 2316	2512	cmd.exe	180
PID 4108 wrote to memory of 2616	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	181
PID 2616 wrote to memory of 4224	2616	cmd.exe	183
PID 4108 wrote to memory of 5924	4108	b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe	184

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe
"C:\Users\Admin\AppData\Local\Temp\b287fc6aca4d79372fcde48991966dba939df82be33d1044521a5b642b6f0057.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:1632
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeUpdate\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeUpdate\" /f
    3⤵
    PID:1220
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyePayload\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyePayload\" /f
    3⤵
    PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh winhttp reset proxy"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\netsh.exe
    netsh winhttp reset proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3832
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f
    3⤵
    PID:6072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Clear-History
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil el"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AMSI/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AMSI/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AirSpaceChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AirSpaceChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Application\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Application\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowFilterGraph\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowFilterGraph\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowPluginControl\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowPluginControl\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Els_Hyphenation/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Els_Hyphenation/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"EndpointMapper\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"EndpointMapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"FirstUXPerf-Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"FirstUXPerf-Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"ForwardedEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"ForwardedEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"General Logging\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"General Logging\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"HardwareEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"HardwareEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"IHM_DebugChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"IHM_DebugChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-I2C/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-I2C/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Debug\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Internet Explorer\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Internet Explorer\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Key Management Service\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Key Management Service\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_DshowReverseBridge\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_DshowReverseBridge\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceMFT\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceMFT\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceProxy\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationFrameServer\""
  2⤵
  PID:5924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationFrameServer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProc\""
  2⤵
  - Executes a command shell one-liner
  PID:4300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProc\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProcD3D\""
  2⤵
  PID:5848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProcD3D\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationAsyncWrapper\""
  2⤵
  PID:5776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationAsyncWrapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationContentProtection\""
  2⤵
  - Executes a command shell one-liner
  PID:2988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationContentProtection\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDS\""
  2⤵
  PID:1104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDS\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDeviceProxy\""
  2⤵
  PID:5612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMP4\""
  2⤵
  - Executes a command shell one-liner
  PID:1992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMP4\"
    3⤵
    PID:876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMediaEngine\""
  2⤵
  PID:3820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMediaEngine\"
    3⤵
    PID:4056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformance\""
  2⤵
  PID:964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformance\"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformanceCore\""
  2⤵
  PID:1728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformanceCore\"
    3⤵
    PID:5516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPipeline\""
  2⤵
  PID:4488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPipeline\"
    3⤵
    - Clears Windows event logs
    PID:1176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPlatform\""
  2⤵
  PID:3268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPlatform\"
    3⤵
    - Clears Windows event logs
    PID:1200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationSrcPrefetch\""
  2⤵
  PID:3752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationSrcPrefetch\"
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\""
  2⤵
  PID:2688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\"
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Admin\""
  2⤵
  PID:3496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Admin\"
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Debug\""
  2⤵
  PID:828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Debug\"
    3⤵
    PID:5084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Operational\""
  2⤵
  PID:3944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Operational\"
    3⤵
    PID:5508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\""
  2⤵
  PID:2904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\"
    3⤵
    PID:4612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\""
  2⤵
  PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\"
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Admin\""
  2⤵
  PID:200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Admin\"
    3⤵
    PID:3432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Debug\""
  2⤵
  PID:4068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Debug\"
    3⤵
    PID:4680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Diagnostic\""
  2⤵
  PID:1968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Diagnostic\"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\""
  2⤵
  PID:5116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\"
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:1244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\"
    3⤵
    PID:5976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\""
  2⤵
  PID:5704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\"
    3⤵
    PID:5916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IE/Diagnostic\""
  2⤵
  PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IE/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:2768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IEFRAME/Diagnostic\""
  2⤵
  PID:3296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IEFRAME/Diagnostic\"
    3⤵
    PID:1356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\""
  2⤵
  PID:4936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\"
    3⤵
    PID:5900
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-OneCore-Setup/Analytic\""
  2⤵
  PID:1328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-OneCore-Setup/Analytic\"
    3⤵
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\""
  2⤵
  PID:3684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\""
  2⤵
  PID:804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\"
    3⤵
    PID:3472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-System-Diagnostics-DiagnosticInvoker/Operational\""
  2⤵
  PID:876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-System-Diagnostics-DiagnosticInvoker/Operational\"
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\""
  2⤵
  PID:4512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\""
  2⤵
  PID:3864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\"
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\"
    3⤵
    PID:1176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\""
  2⤵
  PID:6048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\"
    3⤵
    PID:1376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\""
  2⤵
  PID:3372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\"
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\""
  2⤵
  PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\"
    3⤵
    PID:3076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\""
  2⤵
  PID:5536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\"
    3⤵
    PID:2740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\""
  2⤵
  PID:4336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\""
  2⤵
  PID:1268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\"
    3⤵
    PID:5412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\""
  2⤵
  PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\"
    3⤵
    PID:4380
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Analytic\""
  2⤵
  PID:3220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Analytic\"
    3⤵
    PID:2928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Operational\""
  2⤵
  PID:3416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Operational\"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ADSI/Debug\""
  2⤵
  PID:2380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ADSI/Debug\"
    3⤵
    PID:4948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ASN1/Operational\""
  2⤵
  PID:5004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ASN1/Operational\"
    3⤵
    PID:5316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/General\""
  2⤵
  PID:2744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/General\"
    3⤵
    PID:2148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\""
  2⤵
  PID:1212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\"
    3⤵
    PID:1208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AccelLib-AccelCx/Operational\""
  2⤵
  PID:2572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AccelLib-AccelCx/Operational\"
    3⤵
    PID:5744
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\""
  2⤵
  PID:3948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:2880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Admin\""
  2⤵
  PID:4888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Admin\"
    3⤵
    PID:2664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\""
  2⤵
  PID:5100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\"
    3⤵
    PID:2848
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\""
  2⤵
  PID:5420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\"
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Internal\""
  2⤵
  PID:3740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Internal\"
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppID/Operational\""
  2⤵
  PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppID/Operational\"
    3⤵
    PID:3140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\""
  2⤵
  PID:1580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\"
    3⤵
    PID:2520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\""
  2⤵
  PID:5516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\"
    3⤵
    PID:1348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\""
  2⤵
  PID:708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\"
    3⤵
    - Clears Windows event logs
    PID:1200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\""
  2⤵
  PID:2124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\"
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Verbose\""
  2⤵
  PID:5772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Verbose\"
    3⤵
    - Clears Windows event logs
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:3528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\"
    3⤵
    PID:5436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\""
  2⤵
  PID:4620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\"
    3⤵
    PID:4652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\""
  2⤵
  PID:3932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\"
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\""
  2⤵
  PID:2884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\"
    3⤵
    - Clears Windows event logs
    PID:1684
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\""
  2⤵
  PID:2068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\"
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:3340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\"
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\""
  2⤵
  PID:1544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\"
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\""
  2⤵
  PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\"
    3⤵
    - Clears Windows event logs
    PID:1140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\""
  2⤵
  PID:5936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\"
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppSruProv\""
  2⤵
  PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppSruProv\"
    3⤵
    PID:3516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\""
  2⤵
  PID:3108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\"
    3⤵
    PID:1356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\""
  2⤵
  PID:2736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\"
    3⤵
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\""
  2⤵
  PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\"
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\""
  2⤵
  PID:2236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\"
    3⤵
    PID:4264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\""
  2⤵
  PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\""
  2⤵
  PID:4372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\"
    3⤵
    PID:2120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\""
  2⤵
  PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\"
    3⤵
    PID:4056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\""
  2⤵
  PID:4332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\"
    3⤵
    PID:4060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\"
    3⤵
    PID:3104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\""
  2⤵
  PID:5072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\"
    3⤵
    PID:5732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\""
  2⤵
  PID:1804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\"
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\""
  2⤵
  PID:5780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\""
  2⤵
  PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\"
    3⤵
    - Clears Windows event logs
    PID:924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\""
  2⤵
  PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\"
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\""
  2⤵
  PID:5820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\"
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\""
  2⤵
  PID:4380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\"
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\""
  2⤵
  PID:1884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\""
  2⤵
  PID:2268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\"
    3⤵
    PID:1384
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\""
  2⤵
  PID:6124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\"
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\""
  2⤵
  PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\"
    3⤵
    PID:5976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\""
  2⤵
  PID:5864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\"
    3⤵
    PID:4144
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\""
  2⤵
  PID:4724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\"
    3⤵
    PID:2960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\""
  2⤵
  PID:1208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:3004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\"
    3⤵
    PID:5496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\""
  2⤵
  PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\"
    3⤵
    PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\"
    3⤵
    PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\"
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\""
  2⤵
  PID:4656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\""
  2⤵
  PID:4880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\"
    3⤵
    PID:4376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\""
  2⤵
  PID:1656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\"
    3⤵
    PID:1072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Informational\""
  2⤵
  - Executes a command shell one-liner
  PID:724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Informational\"
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Operational\""
  2⤵
  PID:5732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Operational\"
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Performance\""
  2⤵
  PID:4672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Performance\"
    3⤵
    PID:5824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\""
  2⤵
  PID:3020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\"
    3⤵
    PID:1584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audit/Analytic\""
  2⤵
  PID:2536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audit/Analytic\"
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\""
  2⤵
  PID:5764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\"
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\""
  2⤵
  PID:5084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\"
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\""
  2⤵
  - Executes a command shell one-liner
  PID:5508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\"
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\""
  2⤵
  PID:3432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\"
    3⤵
    - Clears Windows event logs
    PID:1004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\""
  2⤵
  PID:3336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\"
    3⤵
    PID:5872
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AxInstallService/Log\""
  2⤵
  PID:4136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AxInstallService/Log\"
    3⤵
    PID:5976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\""
  2⤵
  PID:5316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\"
    3⤵
    PID:4592
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\""
  2⤵
  PID:5060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\"
    3⤵
    - Clears Windows event logs
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\""
  2⤵
  PID:432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\"
    3⤵
    PID:1496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\""
  2⤵
  PID:5496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\"
    3⤵
    PID:4828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\""
  2⤵
  PID:5020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\"
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\""
  2⤵
  PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\""
  2⤵
  PID:4940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\"
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Backup\""
  2⤵
  PID:2120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Backup\"
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\""
  2⤵
  PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\"
    3⤵
    PID:2932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\"
    3⤵
    PID:3856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\""
  2⤵
  PID:552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\"
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\""
  2⤵
  PID:1200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\"
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Operational\""
  2⤵
  PID:3192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Operational\"
    3⤵
    - Clears Windows event logs
    PID:480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\""
  2⤵
  PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\"
    3⤵
    - Clears Windows event logs
    PID:2712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\""
  2⤵
  PID:1940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\"
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\""
  2⤵
  PID:1776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\"
    3⤵
    PID:5412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\""
  2⤵
  PID:4464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\"
    3⤵
    PID:5344
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:5360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\""
  2⤵
  PID:5416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\"
    3⤵
    PID:4964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\""
  2⤵
  PID:3512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\"
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\""
  2⤵
  PID:4592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\"
    3⤵
    PID:1264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\""
  2⤵
  PID:1356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\"
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\""
  2⤵
  PID:4828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\"
    3⤵
    PID:4520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\""
  2⤵
  PID:3320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCache/Operational\""
  2⤵
  PID:4216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCache/Operational\"
    3⤵
    PID:5324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:3392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\"
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\""
  2⤵
  PID:4056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\"
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\""
  2⤵
  PID:1072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\"
    3⤵
    PID:3604
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\""
  2⤵
  PID:2632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\"
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\""
  2⤵
  PID:3068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\"
    3⤵
    PID:5380
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\""
  2⤵
  PID:764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\"
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CDROM/Operational\""
  2⤵
  PID:1684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CDROM/Operational\"
    3⤵
    PID:3812
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Analytic\""
  2⤵
  PID:3952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Analytic\"
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\""
  2⤵
  PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\"
    3⤵
    - Clears Windows event logs
    PID:5400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\""
  2⤵
  PID:4948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\"
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Call\""
  2⤵
  - Executes a command shell one-liner
  PID:2284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Call\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/CreateInstance\""
  2⤵
  PID:4556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/CreateInstance\"
    3⤵
    PID:1572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\""
  2⤵
  PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\"
    3⤵
    PID:5796
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\""
  2⤵
  - Executes a command shell one-liner
  PID:2960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\"
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\""
  2⤵
  PID:1860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\"
    3⤵
    PID:4520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\""
  2⤵
  PID:5156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\""
  2⤵
  PID:4052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\"
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\""
  2⤵
  PID:2672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\"
    3⤵
    PID:6060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Calculator/Debug\""
  2⤵
  PID:3924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Calculator/Debug\"
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Calculator/Diagnostic\""
  2⤵
  PID:4768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Calculator/Diagnostic\"
    3⤵
    PID:944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\""
  2⤵
  PID:4956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\"
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\""
  2⤵
  PID:5068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\"
    3⤵
    PID:3688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\""
  2⤵
  PID:4284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\""
  2⤵
  PID:5752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:5840
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\""
  2⤵
  PID:5412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Debug\""
  2⤵
  PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Debug\"
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Operational\""
  2⤵
  PID:1004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Operational\"
    3⤵
    PID:6108
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudRestoreLauncher/Operational\""
  2⤵
  PID:3768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudRestoreLauncher/Operational\"
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Debug\""
  2⤵
  PID:5976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Initialization\""
  2⤵
  PID:2044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Initialization\"
    3⤵
    - Clears Windows event logs
    PID:2764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Operational\""
  2⤵
  PID:4296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Operational\"
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\""
  2⤵
  PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\"
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\""
  2⤵
  PID:908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\"
    3⤵
    PID:1984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\""
  2⤵
  - Executes a command shell one-liner
  PID:3012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\"
    3⤵
    PID:1960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\""
  2⤵
  PID:6060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\"
    3⤵
    PID:2076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\""
  2⤵
  PID:2368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\"
    3⤵
    PID:1376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\""
  2⤵
  PID:3000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\"
    3⤵
    PID:1128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\""
  2⤵
  PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\"
    3⤵
    PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\""
  2⤵
  PID:4952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\"
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\""
  2⤵
  PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\"
    3⤵
    PID:3812
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\""
  2⤵
  PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\"
    3⤵
    PID:2636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\""
  2⤵
  PID:5312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\""
  2⤵
  PID:2832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\"
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\""
  2⤵
  PID:3844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\"
    3⤵
    PID:6088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\""
  2⤵
  PID:2644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\"
    3⤵
    PID:1264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\""
  2⤵
  PID:3900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\"
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\""
  2⤵
  PID:1360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\"
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\""
  2⤵
  PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\"
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\""
  2⤵
  PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\"
    3⤵
    PID:4264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\""
  2⤵
  PID:5896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\"
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\""
  2⤵
  PID:3152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\"
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Analytic\""
  2⤵
  PID:472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4236
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Operational\""
  2⤵
  PID:5212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Operational\"
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:3076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\""
  2⤵
  PID:4328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\"
    3⤵
    PID:5884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\""
  2⤵
  PID:4796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\"
    3⤵
    PID:3084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\""
  2⤵
  PID:5928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\"
    3⤵
    PID:5972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\""
  2⤵
  PID:2104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\"
    3⤵
    PID:2448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\""
  2⤵
  PID:1152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\"
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\""
  2⤵
  PID:4272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:1140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/CertInUse\""
  2⤵
  PID:4856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/CertInUse\"
    3⤵
    PID:3264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/KeyMgmt\""
  2⤵
  PID:3676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/KeyMgmt\"
    3⤵
    PID:4896
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\""
  2⤵
  PID:4460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\"
    3⤵
    PID:2764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\""
  2⤵
  PID:4140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\"
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:2016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\"
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\""
  2⤵
  PID:636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\"
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\""
  2⤵
  PID:2848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\"
    3⤵
    PID:3716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\""
  2⤵
  PID:4496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\"
    3⤵
    PID:2224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\""
  2⤵
  PID:1376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\"
    3⤵
    PID:5736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DCLocator/Debug\""
  2⤵
  PID:1128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DCLocator/Debug\"
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\""
  2⤵
  PID:4604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\"
    3⤵
    PID:6056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Logging\""
  2⤵
  PID:2740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Logging\"
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\""
  2⤵
  PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\"
    3⤵
    PID:5400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\""
  2⤵
  PID:832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\"
    3⤵
    PID:5504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Admin\""
  2⤵
  PID:1412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Admin\"
    3⤵
    PID:1140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Analytic\""
  2⤵
  PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Analytic\"
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Debug\""
  2⤵
  PID:5808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Debug\"
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Operational\""
  2⤵
  PID:4896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2812
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\""
  2⤵
  PID:2088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\"
    3⤵
    PID:5364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\""
  2⤵
  PID:4772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Analytic\""
  2⤵
  PID:4968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Analytic\"
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Logging\""
  2⤵
  PID:4736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Logging\"
    3⤵
    PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXP/Analytic\""
  2⤵
  PID:4112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXP/Analytic\"
    3⤵
    PID:2184
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\""
  2⤵
  PID:4780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\"
    3⤵
    PID:4060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\""
  2⤵
  PID:3604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\"
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\""
  2⤵
  PID:1348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\"
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\"
    3⤵
    PID:2180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\""
  2⤵
  PID:2336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\"
    3⤵
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\""
  2⤵
  PID:5708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5344
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\""
  2⤵
  PID:1704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\"
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Operational\""
  2⤵
  PID:4200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Operational\"
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Performance\""
  2⤵
  PID:2272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Performance\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\""
  2⤵
  PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\"
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\""
  2⤵
  PID:5900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\"
    3⤵
    PID:5992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\""
  2⤵
  PID:1400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\"
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\""
  2⤵
  PID:4376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\"
    3⤵
    PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\""
  2⤵
  PID:4816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\"
    3⤵
    PID:1228
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\""
  2⤵
  PID:1464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\"
    3⤵
    PID:2612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\""
  2⤵
  PID:1584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\"
    3⤵
    PID:864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\""
  2⤵
  PID:2516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\"
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\""
  2⤵
  PID:4208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\"
    3⤵
    PID:4316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot\""
  2⤵
  - Executes a command shell one-liner
  PID:2564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot\"
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\""
  2⤵
  PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\"
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\""
  2⤵
  PID:5552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\"
    3⤵
    PID:4844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\""
  2⤵
  PID:4616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\""
  2⤵
  PID:2356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\"
    3⤵
    PID:1796
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\"
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\""
  2⤵
  PID:4212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\""
  2⤵
  PID:2056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\"
    3⤵
    PID:1484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\""
  2⤵
  PID:5760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\"
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\""
  2⤵
  PID:1228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\"
    3⤵
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\""
  2⤵
  PID:3728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\"
    3⤵
    PID:3312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\""
  2⤵
  PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\"
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\""
  2⤵
  PID:3812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\"
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Query/Performance\""
  2⤵
  PID:2636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Query/Performance\"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\""
  2⤵
  PID:5504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\"
    3⤵
    PID:1384
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\"
    3⤵
    PID:1768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\""
  2⤵
  PID:1716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\"
    3⤵
    PID:1148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\""
  2⤵
  PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\"
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\""
  2⤵
  PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\"
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\""
  2⤵
  PID:3412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\"
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\""
  2⤵
  PID:5404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\"
    3⤵
    PID:2976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\""
  2⤵
  PID:5324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\"
    3⤵
    PID:2932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\""
  2⤵
  PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\"
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\""
  2⤵
  PID:2520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\"
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\""
  2⤵
  PID:2180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\"
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\""
  2⤵
  PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\"
    3⤵
    PID:2928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\""
  2⤵
  PID:3696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\""
  2⤵
  PID:4712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\"
    3⤵
    PID:4248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\"
    3⤵
    PID:3264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\""
  2⤵
  PID:3452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\"
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\""
  2⤵
  PID:1132
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\""
  2⤵
  PID:2764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\"
    3⤵
    PID:5984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\""
  2⤵
  PID:3800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:2976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\"
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\""
  2⤵
  PID:5868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\"
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\""
  2⤵
  PID:3856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\""
  2⤵
  PID:4760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\"
    3⤵
    PID:3960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\""
  2⤵
  PID:4360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\"
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\""
  2⤵
  PID:4908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\"
    3⤵
    PID:2148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\""
  2⤵
  PID:4248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\"
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\""
  2⤵
  PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\"
    3⤵
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\""
  2⤵
  PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\""
  2⤵
  PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\"
    3⤵
    PID:1416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\""
  2⤵
  PID:2664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\"
    3⤵
    PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\""
  2⤵
  PID:2968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\"
    3⤵
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\""
  2⤵
  PID:4204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\""
  2⤵
  PID:5756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\"
    3⤵
    PID:2532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\"
    3⤵
    PID:5604
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\""
  2⤵
  PID:4316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\"
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\""
  2⤵
  - Executes a command shell one-liner
  PID:2144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\"
    3⤵
    PID:1312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\""
  2⤵
  PID:4260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\"
    3⤵
    PID:3112
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\""
  2⤵
  PID:4612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\"
    3⤵
    PID:2456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\""
  2⤵
  PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\"
    3⤵
    PID:1680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\""
  2⤵
  PID:3264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\"
    3⤵
    PID:3828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\""
  2⤵
  PID:3240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectSound/Debug\""
  2⤵
  PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectSound/Debug\"
    3⤵
    PID:2604
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Disk/Operational\""
  2⤵
  PID:5560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Disk/Operational\"
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\""
  2⤵
  PID:5368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\"
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\""
  2⤵
  PID:6008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\"
    3⤵
    PID:2760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\"
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\""
  2⤵
  PID:5736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\"
    3⤵
    PID:5548
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\""
  2⤵
  PID:5676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\""
  2⤵
  PID:2172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\"
    3⤵
    PID:1824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\""
  2⤵
  PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\"
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\""
  2⤵
  PID:244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\"
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\""
  2⤵
  PID:1688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\""
  2⤵
  PID:1300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\"
    3⤵
    PID:2868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Documents/Performance\""
  2⤵
  PID:3252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Documents/Performance\"
    3⤵
    PID:5400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\""
  2⤵
  PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\"
    3⤵
    PID:3828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverProxy/Operational\""
  2⤵
  PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverProxy/Operational\"
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverProxy/Performance\""
  2⤵
  PID:1796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverProxy/Performance\"
    3⤵
    - Clears Windows event logs
    PID:624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\""
  2⤵
  PID:1148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\"
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Compositor/Diagnostic\""
  2⤵
  PID:1984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Compositor/Diagnostic\"
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\""
  2⤵
  PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\"
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\""
  2⤵
  PID:4928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:1028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\""
  2⤵
  PID:2224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\"
    3⤵
    PID:2184
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\""
  2⤵
  PID:5336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\""
  2⤵
  PID:1668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\"
    3⤵
    PID:6116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\""
  2⤵
  PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\"
    3⤵
    - Clears Windows event logs
    PID:3088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Debug\""
  2⤵
  PID:924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Debug\"
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Performance\""
  2⤵
  PID:1336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Performance\"
    3⤵
    PID:1844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\""
  2⤵
  PID:1284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\"
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\""
  2⤵
  PID:2456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\"
    3⤵
    PID:4844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\""
  2⤵
  PID:5888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\"
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\""
  2⤵
  PID:3824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\"
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\""
  2⤵
  PID:1632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\"
    3⤵
    PID:5320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\"
    3⤵
    PID:3536
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\""
  2⤵
  PID:2788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\"
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\""
  2⤵
  PID:5048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\"
    3⤵
    - Clears Windows event logs
    PID:4524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Debug\""
  2⤵
  PID:5340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Debug\"
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Operational\""
  2⤵
  PID:1852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Operational\"
    3⤵
    PID:1136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\""
  2⤵
  PID:6084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\"
    3⤵
    PID:1644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/Operational\""
  2⤵
  PID:268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/Operational\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Analytic\""
  2⤵
  PID:2784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4912
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Debug\""
  2⤵
  PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Debug\"
    3⤵
    PID:1324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Operational\""
  2⤵
  PID:5948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Operational\"
    3⤵
    PID:2312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\""
  2⤵
  PID:2084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\""
  2⤵
  PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\"
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\"
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\""
  2⤵
  PID:3444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2040
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\"
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\""
  2⤵
  PID:4264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\"
    3⤵
    PID:2856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\""
  2⤵
  PID:1220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\"
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorClass/Operational\""
  2⤵
  PID:2400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorClass/Operational\"
    3⤵
    PID:3312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\""
  2⤵
  PID:5880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\"
    3⤵
    PID:3764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Debug\""
  2⤵
  PID:2320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Debug\"
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Operational\""
  2⤵
  PID:4060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Operational\"
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\""
  2⤵
  PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\"
    3⤵
    PID:388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Analytic\""
  2⤵
  PID:4420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Analytic\"
    3⤵
    PID:1312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Debug\""
  2⤵
  PID:2376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Debug\"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Analytic\""
  2⤵
  PID:1680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Analytic\"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Debug\"
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Operational\""
  2⤵
  PID:2800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Operational\"
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\"
    3⤵
    PID:4176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Operational\""
  2⤵
  PID:5192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\""
  2⤵
  PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\"
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\""
  2⤵
  PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\"
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\""
  2⤵
  PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Feedback-Service-TriggerProvider\""
  2⤵
  PID:1136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Feedback-Service-TriggerProvider\"
    3⤵
    - Clears Windows event logs
    PID:3104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\""
  2⤵
  PID:1824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\"
    3⤵
    PID:1924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\""
  2⤵
  PID:4992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\""
  2⤵
  PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\"
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\""
  2⤵
  PID:4324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\"
    3⤵
    - Clears Windows event logs
    PID:480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\""
  2⤵
  PID:5012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\"
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\""
  2⤵
  PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\"
    3⤵
    PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\""
  2⤵
  PID:3852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\"
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\"
    3⤵
    PID:1008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\""
  2⤵
  PID:2856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\"
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\""
  2⤵
  PID:1416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\"
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:944
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\"
    3⤵
    PID:3140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\""
  2⤵
  PID:4600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\""
  2⤵
  PID:5380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\""
  2⤵
  PID:5436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\"
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\""
  2⤵
  PID:4912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\"
    3⤵
    PID:1476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\""
  2⤵
  PID:5972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\"
    3⤵
    PID:1272
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\""
  2⤵
  PID:2312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\"
    3⤵
    PID:5132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\""
  2⤵
  PID:1380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\"
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\""
  2⤵
  PID:4128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Debug\""
  2⤵
  PID:2040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Debug\"
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Operational\""
  2⤵
  PID:5264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Operational\"
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4580
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\""
  2⤵
  PID:1484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\"
    3⤵
    - Clears Windows event logs
    PID:3140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\""
  2⤵
  PID:3292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\"
    3⤵
    PID:5196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HAL/Debug\""
  2⤵
  PID:1396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HAL/Debug\"
    3⤵
    PID:704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\""
  2⤵
  PID:1924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\"
    3⤵
    - Clears Windows event logs
    PID:864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\""
  2⤵
  PID:3784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\"
    3⤵
    PID:1392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\""
  2⤵
  PID:252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\"
    3⤵
    PID:4652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Debug\""
  2⤵
  PID:4972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Debug\"
    3⤵
    PID:4708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\""
  2⤵
  PID:2868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\"
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Help/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Help/Operational\"
    3⤵
    PID:4644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\""
  2⤵
  PID:2732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\"
    3⤵
    PID:3560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\""
  2⤵
  PID:4976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\""
  2⤵
  PID:6004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\"
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\""
  2⤵
  PID:3312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\"
    3⤵
    PID:3104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Log\""
  2⤵
  PID:704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Log\"
    3⤵
    - Clears Windows event logs
    PID:5248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Trace\""
  2⤵
  PID:864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Trace\"
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\""
  2⤵
  PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\"
    3⤵
    PID:2592
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\""
  2⤵
  PID:240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\"
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\""
  2⤵
  PID:6088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\"
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\""
  2⤵
  PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\"
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\""
  2⤵
  PID:2912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\"
    3⤵
    PID:1080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\""
  2⤵
  PID:1108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\""
  2⤵
  PID:5044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\"
    3⤵
    PID:4072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-KMCL-Child/Analytic\""
  2⤵
  PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-KMCL-Child/Analytic\"
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\""
  2⤵
  PID:2568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\"
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:3136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\"
    3⤵
    PID:388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\""
  2⤵
  PID:5572
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\"
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IE-SmartScreen\""
  2⤵
  PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IE-SmartScreen\"
    3⤵
    PID:2408
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKE/Operational\""
  2⤵
  PID:4644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKE/Operational\"
    3⤵
    PID:2696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\""
  2⤵
  PID:4964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\"
    3⤵
    PID:1608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\""
  2⤵
  PID:5356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\"
    3⤵
    PID:1960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\""
  2⤵
  PID:1888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\"
    3⤵
    PID:2924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\""
  2⤵
  PID:1780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\"
    3⤵
    - Clears Windows event logs
    PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:5008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\"
    3⤵
    PID:6116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\""
  2⤵
  PID:2928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\"
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\""
  2⤵
  PID:1272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\"
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\"
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\""
  2⤵
  PID:1096
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\"
    3⤵
    PID:5160
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\""
  2⤵
  PID:3456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\"
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\""
  2⤵
  PID:984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\"
    3⤵
    PID:4256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\""
  2⤵
  PID:4764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\"
    3⤵
    PID:3076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:6056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\"
    3⤵
    PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\""
  2⤵
  PID:2480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\"
    3⤵
    PID:3716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\""
  2⤵
  PID:4652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3088
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\"
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:2028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\""
  2⤵
  PID:2424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\"
    3⤵
    PID:2608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\""
  2⤵
  PID:1160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\"
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\""
  2⤵
  PID:5328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\"
    3⤵
    PID:3076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\""
  2⤵
  PID:4072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\"
    3⤵
    PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\""
  2⤵
  PID:3764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\"
    3⤵
    PID:2448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\""
  2⤵
  PID:5956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\"
    3⤵
    PID:4708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\""
  2⤵
  PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\"
    3⤵
    - Clears Windows event logs
    PID:6012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\""
  2⤵
  PID:6108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\"
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\""
  2⤵
  PID:5984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\""
  2⤵
  PID:4176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\"
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\""
  2⤵
  PID:1960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\"
    3⤵
    PID:884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\""
  2⤵
  PID:1644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\"
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\""
  2⤵
  PID:3084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\"
    3⤵
    PID:6116
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational\""
  2⤵
  PID:3168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational\"
    3⤵
    PID:5824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance\""
  2⤵
  PID:3828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance\"
    3⤵
    PID:260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos/Operational\""
  2⤵
  PID:1936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2604
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\""
  2⤵
  PID:4448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\"
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\""
  2⤵
  - Executes a command shell one-liner
  PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\"
    3⤵
    PID:884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\""
  2⤵
  PID:5196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\"
    3⤵
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\""
  2⤵
  PID:1732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\"
    3⤵
    PID:3104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\""
  2⤵
  PID:4528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\"
    3⤵
    PID:388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\""
  2⤵
  PID:1476
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\""
  2⤵
  PID:6012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:2604
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\""
  2⤵
  PID:3308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\""
  2⤵
  PID:5576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\"
    3⤵
    PID:3472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-CPU-Partition/Analytic\""
  2⤵
  PID:2612
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-CPU-Partition/Analytic\"
    3⤵
    PID:2924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-CPU-Starvation/Operational\""
  2⤵
  PID:2780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-CPU-Starvation/Operational\"
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Cache/Operational\""
  2⤵
  PID:3140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Cache/Operational\"
    3⤵
    PID:3772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\""
  2⤵
  PID:1648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Dump/Operational\""
  2⤵
  PID:4708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Dump/Operational\"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\""
  2⤵
  PID:4124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\"
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\""
  2⤵
  PID:2408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\"
    3⤵
    PID:5744
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\""
  2⤵
  PID:1424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\"
    3⤵
    PID:2532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\""
  2⤵
  PID:3148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\"
    3⤵
    PID:4836
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\""
  2⤵
  PID:5548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\"
    3⤵
    PID:1092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\""
  2⤵
  PID:3036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\""
  2⤵
  PID:3560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\"
    3⤵
    PID:5332
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:2608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\"
    3⤵
    PID:3596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\""
  2⤵
  PID:4660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\"
    3⤵
    PID:2704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PRM/Operational\""
  2⤵
  PID:5996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PRM/Operational\"
    3⤵
    PID:1092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\""
  2⤵
  PID:2824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\"
    3⤵
    PID:5224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\""
  2⤵
  PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

goodbye.log

Path C:\Windows\Temp\goodbye.log
Size 2KB
SHA256 fef30191cc0c9514261db8acf772cc666bfd7d8fb3b8a8aec7bbafa2a2bf4344
MD5 ba7a51e61191d176d1a7e588f603b940
SHA1 1cfa9ff4a1a70f87697b5d8cedca572d2b3fb3c2
SHA512 46626077632711b794bed29102c1b3c99985882a7ea91cf5c8f91ae4ed2b635a26262bee78885662f7b34bf9ef30885c21126ccfa7cacb0af357f4d55f4070b1
TLSH
T1C851BFB138E537A62FF25012B12DDA1C831C63FBEAF95B96F1CC28002F99E5485914F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4108-18-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp

Download

memory/4108-22-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp

Download

memory/4108-31-0x00007FF639BD0000-0x00007FF63A0F3000-memory.dmp

Download

memory/4832-14-0x000001B3E8530000-0x000001B3E8552000-memory.dmp

Download