507e14d374d7a1498ce37d4df7dece4528c209f4b7841e87d4cf187af4993f1a

Analysis

user interaction
yes
max time kernel
244s
max time network
282s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
spoooofaaaa.rar
Size 2KB
Sample260831-prhejsge68
SHA256 507e14d374d7a1498ce37d4df7dece4528c209f4b7841e87d4cf187af4993f1a
MD5 e2629da4cbe3abc942e635896f251a98
SHA1 24c7bece42cfb8cb5114b36e787eb81e504d0e30
SHA512 d120512a2dd990cb06de9ba75ee557be17b951a00758a1dc333cc43bf3045ebef6fddbc27b2dc7c1992d96aa6bdeeb4249bddffb7303619ea019b922918fe78a
TLSH
T1D6515E919F3D1F3370959A6C8356D879832810CB5700F8ABBB974450B6C544FFB2C59E
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3432	wevtutil.exe
5568	wevtutil.exe
4768	wevtutil.exe
4568	wevtutil.exe
3268	wevtutil.exe
2372	wevtutil.exe
3328	wevtutil.exe
2496	Process not Found
5744	Process not Found
1340	Process not Found
6112	Process not Found
960	wevtutil.exe
5628	wevtutil.exe
4180	Process not Found
1920	wevtutil.exe
2208	wevtutil.exe
5052	wevtutil.exe
5992	wevtutil.exe
4128	Process not Found
1260	Process not Found
4800	Process not Found
944	wevtutil.exe
4232	wevtutil.exe
1056	wevtutil.exe
4236	wevtutil.exe
1964	wevtutil.exe
5036	wevtutil.exe
3308	wevtutil.exe
4836	Process not Found
5928	wevtutil.exe
5064	wevtutil.exe
5648	wevtutil.exe
1812	Process not Found
2496	wevtutil.exe
1020	wevtutil.exe
5844	Process not Found
972	wevtutil.exe
1316	wevtutil.exe
1576	wevtutil.exe
4152	wevtutil.exe
552	wevtutil.exe
616	Process not Found
5872	wevtutil.exe
4580	wevtutil.exe
1572	wevtutil.exe
4652	Process not Found
4088	wevtutil.exe
3836	wevtutil.exe
1936	wevtutil.exe
2432	wevtutil.exe
4668	wevtutil.exe
3056	wevtutil.exe
1252	wevtutil.exe
1980	wevtutil.exe
5032	wevtutil.exe
248	wevtutil.exe
3960	wevtutil.exe
2868	wevtutil.exe
3124	wevtutil.exe
2848	wevtutil.exe
2256	wevtutil.exe
5988	wevtutil.exe
5400	wevtutil.exe
3744	wevtutil.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
22	discord.com
23	discord.com
27	discord.com
38	discord.com

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
804	wevtutil.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4572_771866783\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2992_580247133\_locales\hr\messages.json	msedge.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1280	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
4656	cmd.exe
4076	cmd.exe
2116	cmd.exe
5336	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2448	msedge.exe
5916	wevtutil.exe
5580	msedge.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
2592	timeout.exe
760	timeout.exe
4168	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5944	taskkill.exe
4236	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326533984891744"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{D3B94A19-BA0A-482E-91F9-A2685D39695E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{7C1CD17B-AB1F-4B3D-B9A5-922603F19650}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	7zFM.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4712	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4712	7zFM.exe
Token: 35	4712	7zFM.exe
Token: SeSecurityPrivilege	4712	7zFM.exe
Token: SeDebugPrivilege	5944	taskkill.exe
Token: SeDebugPrivilege	4236	taskkill.exe
Token: SeSecurityPrivilege	2556	wevtutil.exe
Token: SeBackupPrivilege	2556	wevtutil.exe
Token: SeSecurityPrivilege	4144	wevtutil.exe
Token: SeBackupPrivilege	4144	wevtutil.exe
Token: SeSecurityPrivilege	800	wevtutil.exe
Token: SeBackupPrivilege	800	wevtutil.exe
Token: SeSecurityPrivilege	1676	wevtutil.exe
Token: SeBackupPrivilege	1676	wevtutil.exe
Token: SeSecurityPrivilege	5412	wevtutil.exe
Token: SeBackupPrivilege	5412	wevtutil.exe
Token: SeSecurityPrivilege	3296	wevtutil.exe
Token: SeBackupPrivilege	3296	wevtutil.exe
Token: SeSecurityPrivilege	4092	wevtutil.exe
Token: SeBackupPrivilege	4092	wevtutil.exe
Token: SeSecurityPrivilege	3972	wevtutil.exe
Token: SeBackupPrivilege	3972	wevtutil.exe
Token: SeSecurityPrivilege	1920	wevtutil.exe
Token: SeBackupPrivilege	1920	wevtutil.exe
Token: SeSecurityPrivilege	2208	wevtutil.exe
Token: SeBackupPrivilege	2208	wevtutil.exe
Token: SeSecurityPrivilege	4568	wevtutil.exe
Token: SeBackupPrivilege	4568	wevtutil.exe
Token: SeSecurityPrivilege	4412	wevtutil.exe
Token: SeBackupPrivilege	4412	wevtutil.exe
Token: SeSecurityPrivilege	5844	wevtutil.exe
Token: SeBackupPrivilege	5844	wevtutil.exe
Token: SeSecurityPrivilege	2284	wevtutil.exe
Token: SeBackupPrivilege	2284	wevtutil.exe
Token: SeSecurityPrivilege	5276	wevtutil.exe
Token: SeBackupPrivilege	5276	wevtutil.exe
Token: SeSecurityPrivilege	2828	wevtutil.exe
Token: SeBackupPrivilege	2828	wevtutil.exe
Token: SeSecurityPrivilege	3536	wevtutil.exe
Token: SeBackupPrivilege	3536	wevtutil.exe
Token: SeSecurityPrivilege	2296	wevtutil.exe
Token: SeBackupPrivilege	2296	wevtutil.exe
Token: SeSecurityPrivilege	4880	wevtutil.exe
Token: SeBackupPrivilege	4880	wevtutil.exe
Token: SeSecurityPrivilege	5212	wevtutil.exe
Token: SeBackupPrivilege	5212	wevtutil.exe
Token: SeSecurityPrivilege	4548	wevtutil.exe
Token: SeBackupPrivilege	4548	wevtutil.exe
Token: SeSecurityPrivilege	1784	wevtutil.exe
Token: SeBackupPrivilege	1784	wevtutil.exe
Token: SeSecurityPrivilege	3348	wevtutil.exe
Token: SeBackupPrivilege	3348	wevtutil.exe
Token: SeSecurityPrivilege	712	wevtutil.exe
Token: SeBackupPrivilege	712	wevtutil.exe
Token: SeSecurityPrivilege	3336	wevtutil.exe
Token: SeBackupPrivilege	3336	wevtutil.exe
Token: SeSecurityPrivilege	4744	wevtutil.exe
Token: SeBackupPrivilege	4744	wevtutil.exe
Token: SeSecurityPrivilege	2984	wevtutil.exe
Token: SeBackupPrivilege	2984	wevtutil.exe
Token: SeSecurityPrivilege	3436	wevtutil.exe
Token: SeBackupPrivilege	3436	wevtutil.exe
Token: SeSecurityPrivilege	960	wevtutil.exe
Token: SeBackupPrivilege	960	wevtutil.exe
Token: SeSecurityPrivilege	1252	wevtutil.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4712	7zFM.exe
4712	7zFM.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4712	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4656	4712	7zFM.exe	89
PID 4656 wrote to memory of 4800	4656	cmd.exe	91
PID 4656 wrote to memory of 2864	4656	cmd.exe	92
PID 2864 wrote to memory of 4080	2864	net.exe	93
PID 4656 wrote to memory of 2592	4656	cmd.exe	94
PID 4656 wrote to memory of 760	4656	cmd.exe	95
PID 4656 wrote to memory of 4572	4656	cmd.exe	96
PID 4656 wrote to memory of 4168	4656	cmd.exe	97
PID 4572 wrote to memory of 5236	4572	msedge.exe	98
PID 4572 wrote to memory of 3548	4572	msedge.exe	99
PID 4572 wrote to memory of 5580	4572	msedge.exe	101
PID 4572 wrote to memory of 3548	4572	msedge.exe	99
PID 4572 wrote to memory of 3548	4572	msedge.exe	99
PID 4572 wrote to memory of 3916	4572	msedge.exe	102
PID 4572 wrote to memory of 3916	4572	msedge.exe	102
PID 4572 wrote to memory of 432	4572	msedge.exe	103
PID 4572 wrote to memory of 5272	4572	msedge.exe	104
PID 4572 wrote to memory of 432	4572	msedge.exe	103
PID 4572 wrote to memory of 432	4572	msedge.exe	103
PID 4572 wrote to memory of 5272	4572	msedge.exe	104
PID 4572 wrote to memory of 5272	4572	msedge.exe	104
PID 4572 wrote to memory of 5768	4572	msedge.exe	106
PID 4572 wrote to memory of 944	4572	msedge.exe	105
PID 4572 wrote to memory of 5768	4572	msedge.exe	106
PID 4572 wrote to memory of 5768	4572	msedge.exe	106
PID 4572 wrote to memory of 944	4572	msedge.exe	105
PID 4572 wrote to memory of 944	4572	msedge.exe	105
PID 4572 wrote to memory of 2724	4572	msedge.exe	108
PID 4572 wrote to memory of 2724	4572	msedge.exe	108
PID 4572 wrote to memory of 2732	4572	msedge.exe	109
PID 4572 wrote to memory of 2732	4572	msedge.exe	109
PID 4572 wrote to memory of 2732	4572	msedge.exe	109
PID 4572 wrote to memory of 2304	4572	msedge.exe	110
PID 4572 wrote to memory of 4840	4572	msedge.exe	111
PID 4572 wrote to memory of 2304	4572	msedge.exe	110
PID 4572 wrote to memory of 4840	4572	msedge.exe	111
PID 4572 wrote to memory of 2988	4572	msedge.exe	113
PID 4572 wrote to memory of 2992	4572	msedge.exe	114
PID 2992 wrote to memory of 2308	2992	msedge.exe	115
PID 2992 wrote to memory of 2448	2992	msedge.exe	116
PID 2992 wrote to memory of 1416	2992	msedge.exe	117
PID 2992 wrote to memory of 1416	2992	msedge.exe	117
PID 2992 wrote to memory of 1416	2992	msedge.exe	117
PID 2992 wrote to memory of 260	2992	msedge.exe	119
PID 2992 wrote to memory of 260	2992	msedge.exe	119
PID 2992 wrote to memory of 3228	2992	msedge.exe	124
PID 2992 wrote to memory of 4308	2992	msedge.exe	125
PID 2992 wrote to memory of 4308	2992	msedge.exe	125
PID 2992 wrote to memory of 2716	2992	msedge.exe	126
PID 2992 wrote to memory of 2716	2992	msedge.exe	126
PID 2992 wrote to memory of 2972	2992	msedge.exe	127
PID 2992 wrote to memory of 2972	2992	msedge.exe	127
PID 2992 wrote to memory of 124	2992	msedge.exe	128
PID 2992 wrote to memory of 124	2992	msedge.exe	128
PID 2992 wrote to memory of 3128	2992	msedge.exe	129
PID 2992 wrote to memory of 3128	2992	msedge.exe	129
PID 4656 wrote to memory of 4076	4656	cmd.exe	130
PID 4076 wrote to memory of 5572	4076	cmd.exe	131
PID 4656 wrote to memory of 2116	4656	cmd.exe	132
PID 2116 wrote to memory of 5324	2116	cmd.exe	133
PID 4656 wrote to memory of 5336	4656	cmd.exe	134
PID 5336 wrote to memory of 2532	5336	cmd.exe	135
PID 5336 wrote to memory of 4152	5336	cmd.exe	136
PID 2992 wrote to memory of 1296	2992	msedge.exe	138

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\spoooofaaaa.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO862E0529\zyntheria spoofer.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\mode.com
    mode con: cols=80 lines=30
    3⤵
    PID:4800
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4080
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2592
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/Uya4QPCf2s
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffa962ec188,0x7ffa962ec194,0x7ffa962ec1a0
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,7173324905488767447,13656903781325797193,262144 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,4063907610620248086,6712125428729889418,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
      4⤵
      System Time Discovery
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,6095348000307454450,7807050367637099150,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,6905353596113157862,17336893018309361452,2097152 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,12819169484406914875,8581976228646282558,2097152 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,738361036733355403,3721850789292735931,2097152 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:1
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,9255849217193485953,13844217836451098834,2097152 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:9
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,7582903502187199744,15755234649416650775,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5312,i,10617305661720845740,15937969940564381778,2097152 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9191410368776600700,16320146904344780409,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,8537761719246660778,4893606706477587620,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7227636905150915549,17052068983649833294,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7227636905150915549,17052068983649833294,524288 --field-trial-handle=2348,i,4275463941541504944,6491915417280962284,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffa962ec188,0x7ffa962ec194,0x7ffa962ec1a0
        5⤵
        
        PID:2308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,17453854006205393985,5634260278795671686,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1948,i,13335509614042490328,6430189504397940860,262144 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:2
        5⤵
        
        PID:1416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,5386902862053471568,17722395037286737585,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
        5⤵
        
        PID:260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,16398945231755819578,14202087562266389614,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
        5⤵
        
        PID:236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,16398945231755819578,14202087562266389614,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
        5⤵
        
        PID:3228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,10706187783498379923,243951951965819647,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
        5⤵
        
        PID:4308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,17995103249566092290,17109113677781159380,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
        5⤵
        
        PID:2716
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,6291060392294857488,658608821546103274,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
        5⤵
        
        PID:2972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,6763741394380266500,17487353626019966325,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
        5⤵
        
        PID:124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,15825348663259304546,11920665495250779169,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
        5⤵
        
        PID:3128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1080,i,4381563075543152992,6949158834902749950,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=1256 /prefetch:14
        5⤵
        
        PID:1296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,11837605886220926154,7362534123520337139,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=1064 /prefetch:14
        5⤵
        
        PID:3984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1252,i,1725725020357451297,12547442147034101109,524288 --field-trial-handle=2452,i,767177614878140698,5284706596391133918,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
        5⤵
        
        PID:4316
- - C:\Windows\system32\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
      4⤵
      PID:5572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId
      4⤵
      PID:5324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c vol C: 2>nul | find "Serial"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" vol C: 2>nul"
      4⤵
      PID:2532
  - - C:\Windows\system32\find.exe
      find "Serial"
      4⤵
      PID:4152
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:2432
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid /t REG_SZ /d "453727013-29317-24589-4302-65772252821210" /f
    3⤵
    PID:1212
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductId /t REG_SZ /d "161041103517116-241231565817002-2788974768404-115021824" /f
    3⤵
    PID:2672
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallDate /t REG_DWORD /d 293658295 /f
    3⤵
    PID:1972
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "EasyAntiCheat.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "BattlEye.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Windows\system32\sc.exe
    sc stop vgc
    3⤵
    - Launches sc.exe
    PID:1280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil el
    3⤵
    - Executes a command shell one-liner
    PID:4532
  - - C:\Windows\system32\wevtutil.exe
      wevtutil el
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "AMSI/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "AirSpaceChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Application"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "DirectShowFilterGraph"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "DirectShowPluginControl"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Els_Hyphenation/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "EndpointMapper"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "FirstUXPerf-Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "ForwardedEvents"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "General Logging"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "HardwareEvents"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "IHM_DebugChannel"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS-GPIO/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS-I2C/Analytic"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-GPIO2/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-GPIO2/Performance"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-I2C/Debug"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-I2C/Performance"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Internet Explorer"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Key Management Service"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_DshowReverseBridge"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_MediaFoundationDeviceMFT"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_MediaFoundationDeviceProxy"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MF_MediaFoundationFrameServer"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MedaFoundationVideoProc"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MedaFoundationVideoProcD3D"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationAsyncWrapper"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationContentProtection"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationDS"
    3⤵
    PID:4800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationDeviceProxy"
    3⤵
    PID:1852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationMP4"
    3⤵
    PID:5324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationMediaEngine"
    3⤵
    PID:1876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPerformance"
    3⤵
    PID:5332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPerformanceCore"
    3⤵
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPipeline"
    3⤵
    PID:4576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationPlatform"
    3⤵
    PID:4440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "MediaFoundationSrcPrefetch"
    3⤵
    PID:1208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client-Streamingux/Debug"
    3⤵
    - Clears Windows event logs
    PID:1980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Admin"
    3⤵
    PID:1800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Debug"
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Operational"
    3⤵
    PID:2176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    PID:5116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-AppV-SharedPerformance/Analytic"
    3⤵
    PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-License-Flexible-Platform/Admin"
    3⤵
    PID:1228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-License-Flexible-Platform/Debug"
    3⤵
    PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-License-Flexible-Platform/Diagnostic"
    3⤵
    PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Admin"
    3⤵
    PID:3408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Debug"
    3⤵
    PID:5796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Diagnostic"
    3⤵
    PID:2428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-IE/Diagnostic"
    3⤵
    PID:2896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    PID:3384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-OneCore-Setup/Analytic"
    3⤵
    PID:5272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    PID:1012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    PID:3056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"
    3⤵
    PID:3916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Admin/Debug"
    3⤵
    PID:1296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
    3⤵
    PID:4196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Debug"
    3⤵
    PID:1200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    PID:4560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    PID:408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
    3⤵
    - Clears Windows event logs
    PID:2256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
    3⤵
    PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    PID:432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AAD/Analytic"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AAD/Operational"
    3⤵
    PID:2672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    PID:5968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ASN1/Operational"
    3⤵
    PID:4668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ATAPort/General"
    3⤵
    PID:4600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    PID:5808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AccelLib-AccelCx/Operational"
    3⤵
    PID:1716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-All-User-Install-Agent/Admin"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Admin"
    3⤵
    PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/ApplicationTracing"
    3⤵
    PID:2860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Internal"
    3⤵
    PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:5568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:2204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Verbose"
    3⤵
    PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Admin"
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Analytic"
    3⤵
    PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Debug"
    3⤵
    PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-State/Debug"
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-State/Diagnostic"
    3⤵
    PID:4272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Admin"
    3⤵
    PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Debug"
    3⤵
    PID:1548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Operational"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppSruProv"
    3⤵
    PID:2104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeployment/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeployment/Operational"
    3⤵
    PID:1056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Debug"
    3⤵
    PID:1104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
    3⤵
    PID:4768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Operational"
    3⤵
    PID:5456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
    3⤵
    PID:4188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
    3⤵
    PID:5848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Operational"
    3⤵
    PID:3900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Analytic"
    3⤵
    PID:6032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Debug"
    3⤵
    PID:2784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    PID:4636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
    3⤵
    PID:2580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
    3⤵
    PID:5592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
    3⤵
    PID:1904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"
    3⤵
    - Clears Windows event logs
    PID:3836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
    3⤵
    PID:5932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Debug"
    3⤵
    PID:2700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Operational"
    3⤵
    PID:1460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Performance"
    3⤵
    PID:3204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccess/Admin"
    3⤵
    PID:4740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccess/Operational"
    3⤵
    PID:2996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Admin"
    3⤵
    PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Operational"
    3⤵
    PID:4676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AsynchronousCausality/Causality"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"
    3⤵
    PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/GlitchDetection"
    3⤵
    PID:3272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Informational"
    3⤵
    PID:2504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Operational"
    3⤵
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Performance"
    3⤵
    PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/PlaybackManager"
    3⤵
    PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audit/Analytic"
    3⤵
    PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:4324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
    3⤵
    PID:2160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
    3⤵
    - Clears Windows event logs
    PID:1936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
    3⤵
    PID:5520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
    3⤵
    PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AxInstallService/Log"
    3⤵
    PID:1404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHPORT/HCI"
    3⤵
    PID:1692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
    3⤵
    PID:5180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
    3⤵
    PID:576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Performance"
    3⤵
    PID:400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
    3⤵
    PID:1964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
    3⤵
    PID:944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
    3⤵
    PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Backup"
    3⤵
    PID:4340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
    3⤵
    - Clears Windows event logs
    PID:3432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Battery/Diagnostic"
    3⤵
    PID:2988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Biometrics/Analytic"
    3⤵
    - Clears Windows event logs
    PID:3268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Biometrics/Operational"
    3⤵
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
    3⤵
    PID:4592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
    3⤵
    PID:3844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
    3⤵
    PID:4120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Management"
    3⤵
    PID:1972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Operational"
    3⤵
    PID:1144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/Tracing"
    3⤵
    PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bits-Client/Analytic"
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bits-Client/Operational"
    3⤵
    PID:1348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
    3⤵
    - Clears Windows event logs
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
    3⤵
    PID:3464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
    3⤵
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-Policy/Operational"
    3⤵
    PID:2120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCache/Operational"
    3⤵
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
    3⤵
    PID:3484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
    3⤵
    PID:1324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"
    3⤵
    PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"
    3⤵
    PID:1536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
    3⤵
    PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CAPI2/Operational"
    3⤵
    PID:1304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CDROM/Operational"
    3⤵
    PID:3144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/Analytic"
    3⤵
    PID:4652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ApartmentInitialize"
    3⤵
    PID:896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ApartmentUninitialize"
    3⤵
    PID:3012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/Call"
    3⤵
    PID:2528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/CreateInstance"
    3⤵
    PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ExtensionCatalog"
    3⤵
    PID:964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/FreeUnusedLibrary"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/RundownInstrumentation"
    3⤵
    - Clears Windows event logs
    PID:2208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/Activations"
    3⤵
    PID:4568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/MessageProcessing"
    3⤵
    PID:3816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/Tracing"
    3⤵
    PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Calculator/Debug"
    3⤵
    PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Calculator/Diagnostic"
    3⤵
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertPoleEng/Operational"
    3⤵
    PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
    3⤵
    PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
    3⤵
    PID:2296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
    3⤵
    PID:4880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Cleanmgr/Diagnostic"
    3⤵
    PID:5212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
    3⤵
    PID:4548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudFiles-Filter/Debug"
    3⤵
    PID:1784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudFiles-Filter/Operational"
    3⤵
    PID:3128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudRestoreLauncher/Operational"
    3⤵
    PID:712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Debug"
    3⤵
    PID:3336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Initialization"
    3⤵
    PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Operational"
    3⤵
    PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CmiSetup/Analytic"
    3⤵
    PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"
    3⤵
    PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"
    3⤵
    PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ComDlg32/Analytic"
    3⤵
    PID:4800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ComDlg32/Debug"
    3⤵
    PID:1852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Compat-Appraiser/Analytic"
    3⤵
    PID:5324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Compat-Appraiser/Operational"
    3⤵
    PID:1876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-BindFlt/Debug"
    3⤵
    PID:5332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-BindFlt/Operational"
    3⤵
    PID:3712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-Wcifs/Debug"
    3⤵
    PID:4740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-Wcifs/Operational"
    3⤵
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Diagnostic"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Operational"
    3⤵
    PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Tracing"
    3⤵
    PID:3356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
    3⤵
    PID:3228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
    3⤵
    PID:2176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreWindow/Analytic"
    3⤵
    PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreWindow/Debug"
    3⤵
    PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
    3⤵
    PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
    3⤵
    PID:3408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crashdump/Analytic"
    3⤵
    PID:5520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crashdump/Operational"
    3⤵
    PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CredUI/Diagnostic"
    3⤵
    PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
    3⤵
    PID:1072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-CNG/Analytic"
    3⤵
    PID:5708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
    3⤵
    PID:1296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Debug"
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Operational"
    3⤵
    PID:4352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
    3⤵
    PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/CertInUse"
    3⤵
    PID:2852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/KeyMgmt"
    3⤵
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/Operational"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"
    3⤵
    PID:5684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
    3⤵
    PID:1612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"
    3⤵
    PID:424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"
    3⤵
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAL-Provider/Analytic"
    3⤵
    PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAL-Provider/Operational"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DCLocator/Debug"
    3⤵
    PID:3464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DDisplay/Analytic"
    3⤵
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DDisplay/Logging"
    3⤵
    PID:2120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DLNA-Namespace/Analytic"
    3⤵
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Admin"
    3⤵
    PID:3484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Analytic"
    3⤵
    PID:2204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Debug"
    3⤵
    PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Operational"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DUI/Diagnostic"
    3⤵
    PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DUSER/Diagnostic"
    3⤵
    PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXGI/Analytic"
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXGI/Logging"
    3⤵
    PID:1540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXP/Analytic"
    3⤵
    PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Data-Pdf/Debug"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DataIntegrityScan/Admin"
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
    3⤵
    PID:4272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
    3⤵
    PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"
    3⤵
    PID:1548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"
    3⤵
    PID:3328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Diagnostic"
    3⤵
    PID:3828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Operational"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Performance"
    3⤵
    PID:4784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Scrubbing"
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Defrag-Core/Debug"
    3⤵
    PID:2148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deplorch/Analytic"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
    3⤵
    PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceAssociationService/Performance"
    3⤵
    PID:5220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceConfidence/Analytic"
    3⤵
    PID:4840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceGuard/Operational"
    3⤵
    PID:4364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceGuard/Verbose"
    3⤵
    PID:2940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot"
    3⤵
    PID:2580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
    3⤵
    PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
    3⤵
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Admin"
    3⤵
    PID:2848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Analytic"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Debug"
    3⤵
    PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Operational"
    3⤵
    PID:1552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSync/Analytic"
    3⤵
    - Clears Windows event logs
    PID:972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSync/Operational"
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
    3⤵
    PID:5228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUx/Informational"
    3⤵
    PID:4576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUx/Performance"
    3⤵
    PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Devices-Background/Operational"
    3⤵
    PID:1980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Devices-Query/Performance"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"
    3⤵
    PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"
    3⤵
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"
    3⤵
    PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"
    3⤵
    PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiagCpl/Debug"
    3⤵
    PID:2504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
    3⤵
    PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
    3⤵
    - Clears Windows event logs
    PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"
    3⤵
    PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"
    3⤵
    PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
    3⤵
    PID:1936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
    3⤵
    PID:1760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"
    3⤵
    PID:2896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"
    3⤵
    PID:1808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"
    3⤵
    PID:3916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"
    3⤵
    - Clears Windows event logs
    PID:944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
    3⤵
    PID:1576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
    3⤵
    PID:4352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
    3⤵
    PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
    3⤵
    PID:2852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
    3⤵
    - Clears Windows event logs
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
    3⤵
    PID:5684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"
    3⤵
    PID:1612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"
    3⤵
    PID:424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"
    3⤵
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
    3⤵
    PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
    3⤵
    PID:4260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"
    3⤵
    PID:3464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D10/Analytic"
    3⤵
    PID:2120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"
    3⤵
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/Analytic"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/Logging"
    3⤵
    - Clears Windows event logs
    PID:5568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"
    3⤵
    PID:2204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/Analytic"
    3⤵
    PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/Logging"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/PerfTiming"
    3⤵
    PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D9/Analytic"
    3⤵
    PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3DShaderCache/Default"
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectComposition/Diagnostic"
    3⤵
    PID:1540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectManipulation/Diagnostic"
    3⤵
    PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectSound/Debug"
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Disk/Operational"
    3⤵
    PID:4272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"
    3⤵
    PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
    3⤵
    PID:2912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
    3⤵
    PID:4568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/Analytic"
    3⤵
    PID:3816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
    3⤵
    PID:2284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Cli/Analytic"
    3⤵
    PID:2684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"
    3⤵
    - Clears Windows event logs
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
    3⤵
    PID:5848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Documents/Performance"
    3⤵
    PID:5056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
    3⤵
    PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverProxy/Operational"
    3⤵
    PID:2868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverProxy/Performance"
    3⤵
    PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-API/Diagnostic"
    3⤵
    PID:3128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Compositor/Diagnostic"
    3⤵
    PID:2164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Core/Diagnostic"
    3⤵
    PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
    3⤵
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
    3⤵
    PID:1904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
    3⤵
    PID:3836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-Admin"
    3⤵
    PID:3124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-Operational"
    3⤵
    PID:5932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-SysMm/Debug"
    3⤵
    PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-SysMm/Performance"
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Contention"
    3⤵
    PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Performance"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Power"
    3⤵
    - Clears Windows event logs
    PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
    3⤵
    PID:3356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Application-Learning/Admin"
    3⤵
    PID:3272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
    3⤵
    PID:5372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EFS/Debug"
    3⤵
    PID:2176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EFS/Operational"
    3⤵
    PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ESE/IODiagnose"
    3⤵
    PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ESE/Operational"
    3⤵
    PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Analytic"
    3⤵
    PID:3968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Debug"
    3⤵
    PID:2748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Operational"
    3⤵
    PID:5956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-RasChap/Operational"
    3⤵
    PID:1168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-RasTls/Operational"
    3⤵
    PID:3056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-Sim/Operational"
    3⤵
    PID:3916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-Ttls/Operational"
    3⤵
    PID:944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
    3⤵
    PID:1576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
    3⤵
    PID:4352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorClass/Operational"
    3⤵
    PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
    3⤵
    - Clears Windows event logs
    PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventCollector/Debug"
    3⤵
    PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventCollector/Operational"
    3⤵
    PID:5968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
    3⤵
    PID:4432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog/Analytic"
    3⤵
    PID:5052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog/Debug"
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Analytic"
    3⤵
    PID:2156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Debug"
    3⤵
    PID:1088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Operational"
    3⤵
    PID:4788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
    3⤵
    PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Operational"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
    3⤵
    PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FeatureConfiguration/Analytic"
    3⤵
    PID:1188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FeatureConfiguration/Operational"
    3⤵
    PID:1324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
    3⤵
    - Clears Windows event logs
    PID:3744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
    3⤵
    PID:1536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Debug"
    3⤵
    PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
    3⤵
    PID:1304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
    3⤵
    PID:3144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/Analytic"
    3⤵
    PID:4652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/Debug"
    3⤵
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/WHC"
    3⤵
    PID:1376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/Analytic"
    3⤵
    PID:2528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
    3⤵
    PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/Debug"
    3⤵
    PID:964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
    3⤵
    PID:1920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Debug"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Service/Analytic"
    3⤵
    PID:4480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Service/Debug"
    3⤵
    PID:2104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
    3⤵
    PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"
    3⤵
    PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
    3⤵
    PID:6044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Folder Redirection/Operational"
    3⤵
    PID:2684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Forwarding/Debug"
    3⤵
    PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Forwarding/Operational"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
    3⤵
    PID:5848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GenericRoaming/Admin"
    3⤵
    PID:5056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GroupPolicy/Operational"
    3⤵
    PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HAL/Debug"
    3⤵
    PID:2868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenter/Debug"
    3⤵
    PID:2784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenter/Performance"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"
    3⤵
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HelloForBusiness/Debug"
    3⤵
    PID:5592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HelloForBusiness/Operational"
    3⤵
    PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Help/Operational"
    3⤵
    PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
    3⤵
    PID:4288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
    3⤵
    PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HotspotAuth/Analytic"
    3⤵
    PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HotspotAuth/Operational"
    3⤵
    PID:3204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HttpService/Log"
    3⤵
    PID:616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HttpService/Trace"
    3⤵
    PID:912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
    3⤵
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
    3⤵
    PID:6112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
    3⤵
    PID:920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
    3⤵
    PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
    3⤵
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
    3⤵
    PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
    3⤵
    PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
    3⤵
    PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-KMCL-Child/Analytic"
    3⤵
    PID:4484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
    3⤵
    PID:2708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-VID-Admin"
    3⤵
    PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-VID-Analytic"
    3⤵
    PID:3796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IE-SmartScreen"
    3⤵
    PID:1404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IKE/Operational"
    3⤵
    PID:5272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IKEDBG/Debug"
    3⤵
    PID:1072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-Broker/Analytic"
    3⤵
    PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CandidateUI/Analytic"
    3⤵
    PID:1296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
    3⤵
    PID:4588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
    3⤵
    PID:4196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPAPI/Analytic"
    3⤵
    PID:1040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPLMP/Analytic"
    3⤵
    PID:3048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPPRED/Analytic"
    3⤵
    PID:4560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPSetting/Analytic"
    3⤵
    PID:6092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPTIP/Analytic"
    3⤵
    PID:1212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-KRAPI/Analytic"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-KRTIP/Analytic"
    3⤵
    PID:1972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
    3⤵
    PID:5684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TCCORE/Analytic"
    3⤵
    PID:5808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TCTIP/Analytic"
    3⤵
    PID:1648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TIP/Analytic"
    3⤵
    PID:1348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPNAT/Diagnostic"
    3⤵
    PID:4088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPxlatCfg/Debug"
    3⤵
    PID:1248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPxlatCfg/Operational"
    3⤵
    PID:3464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IdCtrls/Analytic"
    3⤵
    PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IdCtrls/Operational"
    3⤵
    PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
    3⤵
    PID:3484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
    3⤵
    PID:1280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-InputSwitch/Diagnostic"
    3⤵
    PID:4128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
    3⤵
    PID:5404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"
    3⤵
    - Clears Windows event logs
    PID:4232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"
    3⤵
    PID:2800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"
    3⤵
    PID:896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KdsSvc/Operational"
    3⤵
    PID:5412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational"
    3⤵
    PID:3012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance"
    3⤵
    PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos/Operational"
    3⤵
    PID:4500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
    3⤵
    PID:5884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-AppCompat/General"
    3⤵
    PID:4696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-AppCompat/Performance"
    3⤵
    PID:1920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
    3⤵
    PID:4480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
    3⤵
    PID:2104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"
    3⤵
    PID:3816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Boot/Operational"
    3⤵
    - Clears Windows event logs
    PID:1056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
    3⤵
    PID:1104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-CPU-Partition/Analytic"
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-CPU-Starvation/Operational"
    3⤵
    PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Cache/Operational"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"
    3⤵
    PID:1452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Dump/Operational"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"
    3⤵
    PID:3900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
    3⤵
    PID:5056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-File/Analytic"
    3⤵
    PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-IO/Operational"
    3⤵
    - Clears Windows event logs
    PID:2868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
    3⤵
    PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
    3⤵
    PID:1300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
    3⤵
    PID:2164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Operational"
    3⤵
    PID:2580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"
    3⤵
    PID:4404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"
    3⤵
    PID:1904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PRM/Operational"
    3⤵
    PID:3836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
    3⤵
    PID:3124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
    3⤵
    PID:4740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
    3⤵
    PID:1208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"
    3⤵
    PID:1980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
    3⤵
    PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Management"
    3⤵
    PID:3880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
    3⤵
    PID:2288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
    3⤵
    PID:1228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"
    3⤵
    PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
    3⤵
    PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
    3⤵
    PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
    3⤵
    PID:3408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"
    3⤵
    PID:5520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
    3⤵
    PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"
    3⤵
    PID:2896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Registry/Performance"
    3⤵
    PID:1964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
    3⤵
    PID:3056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
    3⤵
    PID:5480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
    3⤵
    PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
    3⤵
    PID:2804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
    3⤵
    PID:2968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"
    3⤵
    PID:3432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"
    3⤵
    PID:4352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"
    3⤵
    PID:4120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"
    3⤵
    PID:4376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"
    3⤵
    PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-XDV/Analytic"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Admin"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Operational"
    3⤵
    - Clears Windows event logs
    PID:5052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Performance"
    3⤵
    PID:424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Known Folders API Service"
    3⤵
    PID:2124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-L2NA/Diagnostic"
    3⤵
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LAPS/Operational"
    3⤵
    PID:1088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LDAP-Client/Debug"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Diagnostic"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Operational"
    3⤵
    PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Performance"
    3⤵
    PID:2060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"
    3⤵
    PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"
    3⤵
    PID:1536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"
    3⤵
    PID:4128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LimitsManagement/Diagnostic"
    3⤵
    PID:5404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
    3⤵
    PID:4232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
    3⤵
    PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LiveId/Analytic"
    3⤵
    PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LiveId/Operational"
    3⤵
    PID:2272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LocationServiceProvider/Debug"
    3⤵
    PID:5412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
    3⤵
    PID:3012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
    3⤵
    PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"
    3⤵
    PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSPaint/Admin"
    3⤵
    - Clears Windows event logs
    PID:5928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSPaint/Debug"
    3⤵
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSPaint/Diagnostic"
    3⤵
    PID:4280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Admin"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Analytic"
    3⤵
    PID:3268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Debug"
    3⤵
    - Clears Windows event logs
    PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Operational"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/DMC"
    3⤵
    PID:6044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/DMR"
    3⤵
    PID:2684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/MDE"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
    3⤵
    PID:1452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
    3⤵
    PID:5848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
    3⤵
    PID:6032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
    3⤵
    PID:2940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
    3⤵
    PID:3128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Minstore/Analytic"
    3⤵
    PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Minstore/Debug"
    3⤵
    PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
    3⤵
    PID:2832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
    3⤵
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
    3⤵
    PID:2796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MobilityCenter/Performance"
    3⤵
    PID:2848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
    3⤵
    PID:3612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
    3⤵
    PID:5324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
    3⤵
    PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics"
    3⤵
    PID:616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
    3⤵
    PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MosHost/Operational"
    3⤵
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MosHost/Performance"
    3⤵
    PID:3228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mprddm/Operational"
    3⤵
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NCSI/Analytic"
    3⤵
    PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NCSI/Operational"
    3⤵
    - Clears Windows event logs
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
    3⤵
    PID:2504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS/Diagnostic"
    3⤵
    PID:2176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS/Operational"
    3⤵
    PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NTLM/Operational"
    3⤵
    PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"
    3⤵
    PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Narrator/Diagnostic"
    3⤵
    PID:3968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ncasvc/Operational"
    3⤵
    PID:2748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
    3⤵
    PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NcdAutoSetup/Operational"
    3⤵
    PID:1168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NdisImPlatform/Operational"
    3⤵
    PID:1600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ndu/Diagnostic"
    3⤵
    PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetShell/Performance"
    3⤵
    PID:4340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-Connection-Broker"
    3⤵
    PID:3324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-ExecutionContext/Operational"
    3⤵
    - Clears Windows event logs
    PID:1576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-Setup/Diagnostic"
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkBridge/Diagnostic"
    3⤵
    PID:2852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProfile/Operational"
    3⤵
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvider/Operational"
    3⤵
    - Clears Windows event logs
    PID:4152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvisioning/Analytic"
    3⤵
    PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvisioning/Operational"
    3⤵
    PID:4432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkSecurity/Debug"
    3⤵
    PID:1612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
    3⤵
    - System Time Discovery
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"
    3⤵
    PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NlaSvc/Operational"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/Operational"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/Performance"
    3⤵
    PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/WHC"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLE/Clipboard-Performance"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLEACC/Debug"
    3⤵
    PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"
    3⤵
    PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
    3⤵
    PID:1536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
    3⤵
    PID:4128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
    3⤵
    PID:5404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"
    3⤵
    PID:4232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Debug"
    3⤵
    PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Operational"
    3⤵
    PID:800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"
    3⤵
    PID:1540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneBackup/Debug"
    3⤵
    PID:3472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneX/Diagnostic"
    3⤵
    PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneX/Operational"
    3⤵
    PID:1796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OobeLdr/Analytic"
    3⤵
    PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OtpCredentialProvider/Operational"
    3⤵
    PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PCI/Diagnostic"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PCI/Operational"
    3⤵
    PID:5928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ParentalControls/Operational"
    3⤵
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Analytic"
    3⤵
    PID:4280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Debug"
    3⤵
    PID:4784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Diagnostic"
    3⤵
    PID:3816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PerceptionRuntime/Operational"
    3⤵
    - Clears Windows event logs
    PID:4768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
    3⤵
    PID:5276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Perflib/Operational"
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
    3⤵
    PID:1008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
    3⤵
    PID:4544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
    3⤵
    PID:2500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
    3⤵
    PID:2636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
    3⤵
    PID:5220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
    3⤵
    PID:4364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
    3⤵
    PID:1784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
    3⤵
    PID:5012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
    3⤵
    PID:2132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PhotoAcq/Analytic"
    3⤵
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PlayToManager/Analytic"
    3⤵
    PID:4308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Policy/Analytic"
    3⤵
    PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Policy/Operational"
    3⤵
    PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
    3⤵
    PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
    3⤵
    PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"
    3⤵
    - Power Settings
    PID:804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
    3⤵
    PID:4160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
    3⤵
    PID:4732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
    3⤵
    PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Admin"
    3⤵
    PID:3192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Analytic"
    3⤵
    PID:5936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Debug"
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    PID:3272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintBRM/Admin"
    3⤵
    PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService-USBMon/Debug"
    3⤵
    PID:1488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Admin"
    3⤵
    PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Debug"
    3⤵
    PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Operational"
    3⤵
    PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode/Operational"
    3⤵
    PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Privacy-Auditing/Operational"
    3⤵
    PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
    3⤵
    PID:3796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
    3⤵
    PID:2896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
    3⤵
    - Clears Windows event logs
    PID:1964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
    3⤵
    PID:3056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
    3⤵
    PID:5480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
    3⤵
    PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Diagnostic"
    3⤵
    PID:4196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Informational"
    3⤵
    PID:620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Performance"
    3⤵
    PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Developer/Debug"
    3⤵
    PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-InProc/Debug"
    3⤵
    PID:4668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Admin"
    3⤵
    PID:1212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Debug"
    3⤵
    - Clears Windows event logs
    PID:3124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Operational"
    3⤵
    PID:4152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
    3⤵
    PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"
    3⤵
    PID:4432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"
    3⤵
    PID:1612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC/Debug"
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC/EEInfo"
    3⤵
    PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RRAS/Debug"
    3⤵
    PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RRAS/Operational"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RadioManager/Analytic"
    3⤵
    PID:1568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RasAgileVpn/Debug"
    3⤵
    PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RasAgileVpn/Operational"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReFS/Operational"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReFsDedupSvc/Operational"
    3⤵
    - Clears Windows event logs
    PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"
    3⤵
    PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoost/Operational"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
    3⤵
    PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"
    3⤵
    PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Regsvr32/Operational"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
    3⤵
    PID:4180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
    3⤵
    PID:2800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"
    3⤵
    PID:896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"
    3⤵
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"
    3⤵
    PID:3296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
    3⤵
    PID:2528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
    3⤵
    PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
    3⤵
    PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
    3⤵
    PID:2208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
    3⤵
    PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
    3⤵
    PID:1548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:3328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
    3⤵
    PID:4908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
    3⤵
    PID:2104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ResourcePublication/Tracing"
    3⤵
    PID:5320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RestartManager/Operational"
    3⤵
    PID:3268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RetailDemo/Admin"
    3⤵
    PID:1104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RetailDemo/Operational"
    3⤵
    PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Graphics/Analytic"
    3⤵
    PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
    3⤵
    PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Networking/Tracing"
    3⤵
    PID:200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
    3⤵
    PID:2952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
    3⤵
    PID:3900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
    3⤵
    PID:4880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
    3⤵
    - Clears Windows event logs
    PID:552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
    3⤵
    PID:6032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
    3⤵
    PID:2868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime/CreateInstance"
    3⤵
    PID:3348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Runtime/Error"
    3⤵
    PID:1300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SENSE/Operational"
    3⤵
    PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/Analytic"
    3⤵
    PID:3808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
    3⤵
    PID:4308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
    3⤵
    PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBClient/Operational"
    3⤵
    - Clears Windows event logs
    PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBDirect/Connectivity"
    3⤵
    PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBDirect/Operational"
    3⤵
    PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Analytic"
    3⤵
    PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Audit"
    3⤵
    PID:4576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Connectivity"
    3⤵
    PID:912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Diagnostic"
    3⤵
    PID:1980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Operational"
    3⤵
    PID:5744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Performance"
    3⤵
    PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBServer/Security"
    3⤵
    PID:3356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBWitnessClient/Admin"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SMBWitnessClient/Informational"
    3⤵
    PID:4836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
    3⤵
    PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
    3⤵
    PID:5372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Schannel-Events/Perf"
    3⤵
    PID:2540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sdbus/Analytic"
    3⤵
    PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sdbus/Debug"
    3⤵
    PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sdstor/Analytic"
    3⤵
    PID:3408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Search-Core/Diagnostic"
    3⤵
    PID:5520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
    3⤵
    PID:2348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SearchUI/Diagnostic"
    3⤵
    PID:1404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SearchUI/Operational"
    3⤵
    PID:1168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecureAssessment/Operational"
    3⤵
    PID:1600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
    3⤵
    PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
    3⤵
    PID:1296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
    3⤵
    PID:3324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
    3⤵
    PID:1576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
    3⤵
    PID:3404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-IdentityStore/Performance"
    3⤵
    PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Isolation-BrokeringFileSystem/Operational"
    3⤵
    PID:2852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
    3⤵
    PID:4120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Mitigations/KernelMode"
    3⤵
    PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Mitigations/UserMode"
    3⤵
    PID:5068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Netlogon/Operational"
    3⤵
    PID:3124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
    3⤵
    PID:2240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP-UX/Analytic"
    3⤵
    PID:1648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-SPP/Perf"
    3⤵
    PID:2156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
    3⤵
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Security-Vault/Performance"
    3⤵
    PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
    3⤵
    PID:1568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SendTo/Diagnostic"
    3⤵
    PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sens/Debug"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SenseIR/Operational"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sensors/Debug"
    3⤵
    PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sensors/Performance"
    3⤵
    PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
    3⤵
    PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ServiceReportingApi/Debug"
    3⤵
    PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Services-Svchost/Diagnostic"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Services/Diagnostic"
    3⤵
    PID:4180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Servicing/Debug"
    3⤵
    PID:2800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Setup/Analytic"
    3⤵
    PID:896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SetupCl/Analytic"
    3⤵
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SetupPlatform/Analytic"
    3⤵
    PID:1540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SetupQueue/Analytic"
    3⤵
    PID:3472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SetupUGC/Analytic"
    3⤵
    PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
    3⤵
    PID:1796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
    3⤵
    PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"
    3⤵
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
    3⤵
    PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"
    3⤵
    PID:4768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-Core/ActionCenter"
    3⤵
    PID:4188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-Core/AppDefaults"
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-Core/Diagnostic"
    3⤵
    PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-Core/Operational"
    3⤵
    PID:4200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"
    3⤵
    PID:5220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"
    3⤵
    PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-Shwebsvc"
    3⤵
    PID:4364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
    3⤵
    PID:4704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"
    3⤵
    PID:2352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"
    3⤵
    PID:2132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Shsvcs/Diagnostic"
    3⤵
    PID:916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SleepStudy/Diagnostic"
    3⤵
    PID:4684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmartCard-Audit/Authentication"
    3⤵
    PID:1904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"
    3⤵
    PID:4800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"
    3⤵
    - Clears Windows event logs
    PID:2848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"
    3⤵
    PID:1388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmartScreen/Debug"
    3⤵
    PID:5312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmbClient/Audit"
    3⤵
    PID:5572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmbClient/Connectivity"
    3⤵
    PID:1208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmbClient/Diagnostic"
    3⤵
    PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SmbClient/Security"
    3⤵
    PID:920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
    3⤵
    PID:6112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Spell-Checking/Analytic"
    3⤵
    PID:3228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SpellChecker/Analytic"
    3⤵
    PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Spellchecking-Host/Analytic"
    3⤵
    PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SruMon/Diagnostic"
    3⤵
    PID:2504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SrumTelemetry"
    3⤵
    PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StateRepository/Debug"
    3⤵
    PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StateRepository/Diagnostic"
    3⤵
    PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StateRepository/Operational"
    3⤵
    PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StateRepository/Restricted"
    3⤵
    PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorDiag/Operational"
    3⤵
    PID:1760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorPort/Operational"
    3⤵
    PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ATAPort/Admin"
    3⤵
    PID:2896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ATAPort/Analytic"
    3⤵
    PID:1964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ATAPort/Debug"
    3⤵
    PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ATAPort/Diagnose"
    3⤵
    PID:5480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ATAPort/Operational"
    3⤵
    PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Admin"
    3⤵
    PID:2804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Analytic"
    3⤵
    PID:620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Debug"
    3⤵
    PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"
    3⤵
    PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-ClassPnP/Operational"
    3⤵
    - Clears Windows event logs
    PID:4668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Disk/Admin"
    3⤵
    PID:1212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Disk/Analytic"
    3⤵
    PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Disk/Debug"
    3⤵
    PID:5856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Disk/Diagnose"
    3⤵
    PID:5556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Disk/Operational"
    3⤵
    PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-NvmeDisk/Analytic"
    3⤵
    PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-NvmeDisk/Diagnose"
    3⤵
    PID:2240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-NvmeDisk/Operational"
    3⤵
    PID:1648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Storport/Admin"
    3⤵
    PID:2156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Storport/Analytic"
    3⤵
    PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Storport/Debug"
    3⤵
    PID:1944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Storport/Diagnose"
    3⤵
    PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Storport/Health"
    3⤵
    PID:1568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Storport/Operational"
    3⤵
    PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Tiering-IoHeat/Heat"
    3⤵
    PID:1596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storage-Tiering/Admin"
    3⤵
    PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageManagement-PartUtil/Operational"
    3⤵
    PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageManagement/Debug"
    3⤵
    PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageManagement/Operational"
    3⤵
    PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSettings/Diagnostic"
    3⤵
    PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-Api/Operational"
    3⤵
    PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-Driver/Diagnostic"
    3⤵
    PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-Driver/Operational"
    3⤵
    PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-Driver/Performance"
    3⤵
    PID:4180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-ManagementAgent/WHC"
    3⤵
    PID:2800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-Parser/Diagnostic"
    3⤵
    PID:896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-Parser/Operational"
    3⤵
    PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic"
    3⤵
    PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageSpaces-SpaceManager/Operational"
    3⤵
    PID:3472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageVolume/Diagnostic"
    3⤵
    PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-StorageVolume/Operational"
    3⤵
    PID:1796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Store/Operational"
    3⤵
    PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Storsvc/Diagnostic"
    3⤵
    PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Subsys-Csr/Operational"
    3⤵
    PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Subsys-SMSS/Operational"
    3⤵
    PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sudo/Admin"
    3⤵
    PID:5844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Superfetch/Main"
    3⤵
    PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Superfetch/PfApLog"
    3⤵
    PID:2304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Superfetch/StoreLog"
    3⤵
    PID:1512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Sysprep/Analytic"
    3⤵
    PID:4768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-System-Profile-HardwareId/Diagnostic"
    3⤵
    PID:4188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SystemSettingsHandlers/Debug"
    3⤵
    PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SystemSettingsThreshold/Debug"
    3⤵
    PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SystemSettingsThreshold/Diagnostic"
    3⤵
    PID:468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-SystemSettingsThreshold/Operational"
    3⤵
    PID:4200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TCPIP/Diagnostic"
    3⤵
    PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TCPIP/Operational"
    3⤵
    PID:3832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TSF-msctf/Debug"
    3⤵
    PID:264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TSF-msctf/Diagnostic"
    3⤵
    PID:1784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TSF-msutb/Debug"
    3⤵
    PID:5012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TSF-msutb/Diagnostic"
    3⤵
    PID:1300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TTS/Diagnostic"
    3⤵
    PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TWinAPI/Diagnostic"
    3⤵
    PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TWinUI/Diagnostic"
    3⤵
    PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TWinUI/Operational"
    3⤵
    PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TZSync/Analytic"
    3⤵
    PID:3612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TZSync/Operational"
    3⤵
    PID:1028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TZUtil/Operational"
    3⤵
    PID:5932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TaskScheduler/Debug"
    3⤵
    PID:3204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TaskScheduler/Diagnostic"
    3⤵
    PID:4580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TaskScheduler/Maintenance"
    3⤵
    PID:4160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TaskScheduler/Operational"
    3⤵
    - Clears Windows event logs
    PID:1572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
    3⤵
    PID:3452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TenantRestrictions/Operational"
    3⤵
    PID:5732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
    3⤵
    PID:3620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
    3⤵
    PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
    3⤵
    PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
    3⤵
    PID:3016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
    3⤵
    PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
    3⤵
    PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
    3⤵
    PID:4816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
    3⤵
    PID:2176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
    3⤵
    PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
    3⤵
    PID:4292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
    3⤵
    PID:2708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
    3⤵
    PID:1936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
    3⤵
    PID:2748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Admin"
    3⤵
    PID:1404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Analytic"
    3⤵
    PID:5956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Debug"
    3⤵
    PID:3440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-Printers/Operational"
    3⤵
    - Clears Windows event logs
    PID:3056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
    3⤵
    PID:4340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
    3⤵
    PID:4588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
    3⤵
    PID:2264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
    3⤵
    PID:1040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
    3⤵
    PID:3048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
    3⤵
    PID:4560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
    3⤵
    PID:6092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
    3⤵
    PID:4376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
    3⤵
    PID:5968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
    3⤵
    PID:2876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
    3⤵
    PID:4152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
    3⤵
    PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
    3⤵
    PID:1348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Tethering-Manager/Analytic"
    3⤵
    PID:1612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Tethering-Station/Analytic"
    3⤵
    PID:3080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ThemeCPL/Diagnostic"
    3⤵
    PID:4260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ThemeUI/Diagnostic"
    3⤵
    PID:3380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Threat-Intelligence/Analytic"
    3⤵
    PID:4088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational"
    3⤵
    PID:4976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Time-Service/Operational"
    3⤵
    - Clears Windows event logs
    PID:3308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Troubleshooting-Recommended/Admin"
    3⤵
    PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Troubleshooting-Recommended/Operational"
    3⤵
    PID:1324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-TunnelDriver"
    3⤵
    PID:3744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
    3⤵
    PID:1280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UAC/Operational"
    3⤵
    PID:2204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UIAnimation/Diagnostic"
    3⤵
    PID:6136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UIAutomationCore/Debug"
    3⤵
    PID:1304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
    3⤵
    PID:5868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UIAutomationCore/Perf"
    3⤵
    PID:4936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl "Microsoft-Windows-UIRibbon/Diagnostic"
    3⤵
    PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:2160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bd8bb99b268dbf861b813a94dc6f0fc53d415cc2a45e6741ddcc8d207c198871
MD5 a39eca0d95bef3fa9e3db9bd0230323b
SHA1 ef56498229145a5ff21d01d98fe0e94dd6c79719
SHA512 0627d13debe5cbd872ec7064f1e604759a6ce09006ffd57a5074356323c0eb3fc677bc3f7d2b1214dea34a3e1aecdd67f2e4d0795f5015efa0ccb383263a7727
TLSH
T1B9D0A7A43685B50AE7451072B9665341A35689117996D205C010B21EDE591A167EF1CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsSiteData

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsSiteData
Size 28KB
SHA256 6bd856d68d3a2de856e64d766e2b9baacbe909d793087e84880050cb36bab1e1
MD5 faa1297eb819d33082266d374c1d492d
SHA1 91a6155f8d8c05c277e8460a7268de023f8ceec5
SHA512 120a94377078e09c960d070f09a417479708753b708a3bb148c118fa48faf12d85352317712b9d95b59d15cf5c90f1c0490f703ee4524c6bcd7f1c427e499ef3
SSDEEP 12:TLiqiw5xT5SmKT5Si8wT5SislpXUUfzBW8ybwaW2b8wAs76uvsUkHZ6HFxOUwa52:TLiq5byqkiXBzlRr6hkc6UwccI5fBG
TLSH
T149D29B8A5F32E951CAE0D63BB0C0866A9B34A2198BC26D531B1110328FC3401983B47D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1ed7fe94e4a6736a7e15a64913b2c83d2c7b6d17b7df6a6e52b65a77903bc11f
MD5 65d6d3d2b66e0cf362f129a77db9d9d9
SHA1 675f2d3dbbeb46be6013cb03e0bea7a6ef803e35
SHA512 c1941fef1ebff051089a218252d3f9a01df1fff3b2dcfbd991d43517e266f0dbd9b179e74cd9f0c0e735cd2f9e4c672e143c6e04f29b01e8c50e1a99fd1c4edf
TLSH
T192E02B99CC11BC3728FD1B29B0A04B46E754130B2B41860F3B3C810D8FF163742DA81C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 eef2891b2c7de647313d6115f39f393845445ed4a4414084557080d570332df2
MD5 9c31fe4c001bd4af9f18341b5350ef84
SHA1 8a0f1a1dda6565fd71a6343f7692ac333fce8a19
SHA512 b2df59f94fb321bed8e6c32dad0471c87f2dde5df0267e51a2ad0b0ac9fa027596eafe9500efde31a285578001cb8a4b854b9f5569ad9de1fb01850f8979bca2
SSDEEP 384:R97/Gp/MEeIsOQDKXolkDhUmu0uPeAFDe9EukH:R9qIBK4TmuNy+u
TLSH
T1C813713DB2126E12E7DA003D0C4FAA79F332D869D9E551E3633A352A2711FA258CF517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e83209ce78f7678a2191c0e15e6b1f97550c2713bcbf971bad3a1dec2bf46086
MD5 e6fb2fdb68fb359a1771cda1f88e20d5
SHA1 7c07e93d4968f72f20165873e4269f8991b8c6dd
SHA512 8bc96535448f7bad813e29523cafd414e8a94d7b9186674d558e3f318986648d32802d04c9c03007639d30a96b495a2a5540a21a39f605641849482108c64fe3
SSDEEP 3072:UXwL/5L/eUM1hyb1L/ZL/WL/eb4R7f8bOw:UXwL/5L/Rb1L/ZL/WL/ykEbO
TLSH
T19844C5F34940641ACBB802F593033A3DD277454D7CD6E9EAE1790CC92829F32B6B9E95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 13e8a73a3fb1df93a06ff297b39a82e7962d116976cfdf3f048f755ff4505e5b
MD5 8a9ddbe0de7f08f0c5277cafc56a9a11
SHA1 47ea58e239e06ab85769ede053c3e8ef818ce157
SHA512 a89429e54770dc1fa903e0fd14249a8dfa69b771c26bb9d92414b6beb8724f6c039c4e27c9f4bd4397abd38fee6dac3913047aef3e10a7d4228a3fc4ef0d3ae0
SSDEEP 3072:9v9G+HNF7JiHv6K42b770g79DkbO1iAyyvkknpzLoZrM5shZV:9Q8/7Jc6KdN51iAPVL0NV
TLSH
T1D2255CDBC7641ED2DBABDF70B9C0DC1A7E7420C1AACAE0836441C6B945C37C53AA519D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 71f8ab083e75bf7c733f7975a6ff0275b46bc2f841203078ea2ed492111aa3d7
MD5 0755b06d59348f1d2429aa57f0b5bab2
SHA1 ae5eeeded69c83fdc428b1865bf7c948acb10430
SHA512 c4d9ab1228e5f3830ae2432db64be1311111aa29323cebe527724db5c73495e95b823fa4f3469cb3446de9b6f86200b4637c2de9592d8b88a6771a86a0da9abb
SSDEEP 24576:fH9yij4MP0StZl84JIhZZ4dKx29v9HE8qhQJZcLAo:fdynMP0huI/c9VHE8qiD
TLSH
T19F167DEDCA7858C3CE639A30B4F0E9577C7413C3F594C1D68898C584026BBC5BFAA669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 66b75e1f369fd4fd498587432c9ee08c347b4d141271f0b7ed8d8568dce1f084
MD5 472c58bc075cedd53fbf77839172c6c3
SHA1 13c874f8dd93ae7ec346e45dd944312df4c98a28
SHA512 56757f832dd5d21b2cf1233bf5d548461af0a3cb506fe7cfcd2ddbd492c239fe79df7f70979e0f81418f18cd6b45809dd2a700228b1a91eab6b519a4c84bf615
SSDEEP 48:qfy98FWgRJ4HqowV5BYEbyLb0jMJJzHfxBZIwfE2nUFo6Rg:qfG8FW8WKju1SMJ9pBbfEnFw
TLSH
T1E0914F16136B4A91CF774CBC02E9A49AF6FB9980053BAFE02055BD7C4485F4BE0C7293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5ba95c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ba95c.TMP
Size 3KB
SHA256 4f351491f788c12fd00f19ad23451093fd6ff8a343257259e1e064ad7a93e669
MD5 1bcf91d66d7b0896eeff3599d4d60049
SHA1 0acfde60d14342fa0f24c2f545040182dfc54ca7
SHA512 880f45ccba28e23f533009d34f43ebe75468068db446b9430fede7cf51dffc996fc3c2b866e512028cfcd32151a92be54db9053612aebda329f11a595af6fc9a
TLSH
T11C61C55623634DD1DF7744BD52E96898FAF4A895093B2EC06054BEBC48C6F0BC0C32A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 abe7009c59d8d7647cee8544eba3536daca0879cba0f40a3955e6201f6793637
MD5 39f8f253d3b85667e2b6856ed05a341d
SHA1 3c880092e7b440277a312b153cd069061a0e215c
SHA512 64060057b775da212bfd2678373627996784a922cf761438a8f3b6ccf235a6b338985d7cab7860ccdea7c59917007743f7b0200688325671782f42fa582aed14
TLSH
T175E0D8A4E9C6C12D5A2174C391647708D2C43A57D7CBFD4B1720C8C57A43122B65A947
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 285B
SHA256 fff9c841af450dfefe7f284f645d4a26b048e6bd5709ad766b308172bc260a53
MD5 785c71b68bf89a0e9973e06d76434ab1
SHA1 2eb96ed892a724f5f223fe37abbd075d448d45e3
SHA512 a84d94a4b22d325a41b84c193a2e279bc3969085d87eda3fad0dc1032989bd26e67aba7cefa085838590e5aef8958c40e22a000d158fd80782b614dcdbc55030
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 0ff6dea2beb02ffe6412627aa8a7e75ab97049fb4366b28742a0e874e828391c
MD5 4d972c0ec3a6a7e27266982a34832ee0
SHA1 35676d58a9cda29b1ebcf5bdcace141280574552
SHA512 bb4410ecf9a09e2537110c91845313588f0991a69fca3af2e0fe2e9aa75b3a1a9fcd873ccee41fffc7d8c42ab9a0cdd2458eaf09e9d93240fcc06fe7eed4c1b4
TLSH
T164E0260448E8E23995646DD3C26C730892E03603A3C8BE0A277E8844720238AE3CF284
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 f6000db1cfd004044ebf43b4e5b44cc412ad9cb240d575807accb15a15220963
MD5 7aa22c59ea27ab739a1f7f3ef44993fd
SHA1 872d02f0162184618a15576d8dc7f01e564fae1b
SHA512 0dddb5ac1c4b92597308876127816a62fbbc775960f1b2089909c82d3415ecf64ba78d437d1caef6dbe18728b21168fa02db9d81de1a4cf409a2b6852badb4f0
SSDEEP 48:uzBmw6QU1PzEfwJOrZjrte3FJu4yeRvXhGg12AxyUNe:6BCxkwAr5M3FJu4yYvXhz1Xxxe
TLSH
T1DD92B5970D393853F7092B7A262B4839C93BE19CFFA5CC99312550791DF8662A0358EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 224KB
SHA256 bcb8bf60aee12e45a368f465458e9ae83237ba2a4617a879e167a7726abdaef0
MD5 17e5c66b8bd76a8a78f0fd4221608dbd
SHA1 08af4c93c9a87e66277058bd10adc98e9a700515
SHA512 052fa1927b083f7603c3b6da986b41009010ebc16d8403ae02282504c266799bf61716cddcbd7b1a2cf7ff37340aed3b21abd64788499776d270e62ff0d908f2
SSDEEP 96:pwzVHtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/oQRbbEOVpZf24JkMfXSFR+Cw:pTH+bF+UI3iWGVoWN3qL/dVVV63
TLSH
T11124111F5F243722CDBD913668E744A35C7DF03F8B5366DA686114B4CEE2642A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 357B
SHA256 f3d819149109fcbf2c2e2b495c41e76de30ab4bd2fbdd7fbed4a7bb362c74256
MD5 33b0d9d55cbecafbbf8275bed2362edb
SHA1 e2853d0b8d2e085f300fd2f88a5c926b33f29319
SHA512 958113c603c02b8b16103bff64e3d77f70b3df12d012cc7ab6e89e88e0f3688518f52edc0cae321004136867e7c85c3f57fb883fef689e237783f462935678ea
TLSH
T131E0D8B7C62C4C786B9815F01263320CDE9711AC19BFDAC6E142390408486362114DD6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 553f7b74e76ea9c3d8dbbb9df844d3d5a9c3df50ec76f700e4ba32245fa9ee93
MD5 2d0b88ddcc71ab375c5f91c30097cc21
SHA1 76e925ae48b8baaf4d17136bba0991c6601d3c35
SHA512 f2078fa02dcfb3c017c48a36aef4634e9f0fefa3b324ba20f90247696ded866e012ecc76a48014ee41a99eb1bd17d8e84b5a30486b67af2448cd9cc4a8c28044
TLSH
T1BCE0D86184CDC12D5544649B92587B08C3E03707E7CAFA495B149849BC02208E28B1C5
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 24KB
SHA256 b50757e6afba151ffa052c1954405a3f469f1f6d7a17af697f17de9b187a5143
MD5 30220fba939e89d02d53f01a360317ae
SHA1 4f49a64c119d77ea5777692527431c747356ee6d
SHA512 71026f03a00e2e4c3ba4f839e9f2b9094bf3a77d41aa66013775bfebfadaa035acf3bed19c990ba2d9368d2a2c3c72a22207186886d46f2fa05b79defb677c4e
SSDEEP 48:Txk/LopFMaty423w/a9NUuTTdwp658X9cHLt+iENjQHNI4jIPj4HNxE1opcy0zOm:qDeMatha9Vd3gcZiGIPjgEBy0yY+Ur
TLSH
T138B2F84F9F143553D1F896FADCD5442A2F2C106C8723699BE918A0B28DA67A778028F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 008aeb5430f1d32ea381abc0e3507e319f7fa7b449fe9fe9b68f90032a9036af
MD5 e97967a36c34b14d243030f207a6fdf8
SHA1 4d2ed5fecdbc93aaf3db32d01a2c78dc045fd954
SHA512 13072de91e655cd3ff3435b9b5470d57772c60082b101458ab6e3da882fd83728f08f4b06c93b1842721c289423293275224224d61217deef5e1c60824b94500
TLSH
T100418DF783E8866D8A1195F4AB146E2FCF1D0955432C3D5AC4E4AE1B93E3471E18099F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8b86a6253b319cc9bc92ea0bde6efc3c37c6bcd0ee0975c96adc07d9f2bc9fbf
MD5 cbbd44781709eb8aad528815ace66d5f
SHA1 ddf55ddd01085adb6cdc677f005fa90bbdc29fcf
SHA512 dbff3582df5cbd86e168dc23081ced5bdb4252b87c2ca47f460724acb3895c9facc3e055b06e11b62fefe187a44018a1238be2ebd1241ef4193559ec2d99f8d1
TLSH
T122419DF783F8866D8A1191F4AB086E2FCF1D0915431C7D6AC4E49E1B93E3471E140A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL
Size 36KB
SHA256 c1ff8d6b61dd65df181067f95fa4f03d4de837d75caf6ed13d0f03635d111b64
MD5 7dde2c1e23beb57c745480eb124070c3
SHA1 62c62bc5e97875d59ea9b125ee1ac56ba79ca53c
SHA512 8f534f362e810244faca286b60cd0df2d124f9196f9c7e21ba79b1ac202ef7555d176cf6b938ba268cca2fbdd4c6d05b46842e22abf1e5d8950abb117bc20f93
SSDEEP 96:i/IEumQv8m1ccnvS6wEHZUyWnlIOxpyYf1endjIOxpydnFNIkm/jQ4mVIoZ4g:i/IEumQv8m1ccnvS6InlN8nJNyRJ
TLSH
T19BF213FB06379209D58440F0A100AF9EAF16005B47B6B6ECB7C44BE3FB931E2B16575A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 bc028efe95c2af125762dc9be6a90477170a33341bac0ce9acc5ef6b6d58b4d9
MD5 2b0190883bc4b5caac5a237b6a8353fa
SHA1 27b69f7a54f541cf4b5cc6b4ed981dd852babb9a
SHA512 476244d77bae6520f4d6ee7ff25b4299957ce9a7e594dd89835c3ca226e254d81146c8feab0e6054f6093648d4e8240f3ab839ffd930dc4a094486f6407e3b2d
TLSH
T174F0E9A3C4B9F4336038597F0F85780129BDF939210594F5CD99C63CE55A4F7972283A
MD5 SHA1 SHA512 TLSH

Submit Download

a7f0fad1-4713-493a-b9cc-106424f2b4ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7f0fad1-4713-493a-b9cc-106424f2b4ff.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 56a2c61af35cc4b4663b9f4f02c83273367affe327921f4cbdf4440f7c91a949
MD5 12fd639bcc1fa265f26df3b9150cb648
SHA1 f7177831c65ba2b9ea8eee1e924bb4c2ffe9f5ab
SHA512 55a0913b337e7b3d7da7a3abe303370d377c24838957d83a201b17da2d8ee0320b83b8329a77031fdd9df1ac78373be9e395e3f57eafea03ac4462a7f2180b2e
SSDEEP 192:sxRlRWCw/fKsNWpVYDprQ5/zoA8plf/g6+WNyUAr/YHRshirgsIgV3J:sxRlnw/fKsNWvYDHt/5w/iqi1n
TLSH
T1D542D716AD28AD7B8CC7D61DFB157F53D2F95426A1D12E44A6FC8A1C00EB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7a62625d88e83a9a68ff044a619f20ee468a0734fa7e3c0ce5b7515f9d0bca79
MD5 b1ffc9543c725b221eedfa1926b4ef52
SHA1 c4b9c68a22bd9bd89b948cce1e55343e34a8c722
SHA512 ea32f1e9fe25be491942e4c629e6e936dde42f0e078bc2ce9955cf06c3df68c97e7d9c7512d3f10cca1962461789e64bc6e875174a206b81b2ee87bfac039e62
SSDEEP 192:sxRlRWCw/fKsBbWpVYRIZj49ntzoA8plf/g6+WNyUAr/YHRshi5GsIgVhF6J:sxRlnw/fKsJWvYR2UGt/5w/iqi1s
TLSH
T11042D616AD28A97B8CC7D61DFB157F23D2F95526A0D11E08A6FC8A1C14EB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 919d82d08e92e00f08ea41afc6f5dfbd39447ad4fd578b4c39feb325edbb419f
MD5 b7cc6d5ce3fe139c2e9a05f6227b64cf
SHA1 e52f10ccdd13c9d77033da14e11de478dfee8aa8
SHA512 1695b19f585c5da2219314cdc7e738d2fb5e4c21e94f1df7acbec8a5118c75da12388ad037a2fec55751df64a7c30701ad23a93b6e74933a8193351d0d7dd5a2
SSDEEP 192:sxR+RWCw/fKsNbWpVYMIZj49ntzoA8plf/g6+WNyUAr/YHRsChi5GsIgvhF6J:sxR+nw/fKsFWvYM2UGt/5w/isAi1S
TLSH
T12452D616AD28A97B9CC7D61DFB157F23D2F95526A0D11E08A6FC8A1C10EB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 094a1e8f0ad606b068ec1085b273b57974a838a12d5a853148f33473b6343610
MD5 42d2ab6f560ffe11759cde88d8443dec
SHA1 34d68af270c8af3925aa8dc0aac2b904afa42de2
SHA512 8e9e5daa125afcaa3b504c211c0740467b29cc69ba1ee56e7302118300dc8f173379eaee317337ed10ce37fb4f1f97c335f41988eb3a24e5aed244f0b0ce3b0f
SSDEEP 192:sxR+RWCw/fKsNbWpVYRIZj49ntzoA8plf/g6+WNyUAr/YHRshi5GsIgVhF6J:sxR+nw/fKsFWvYR2UGt/5w/iqi1s
TLSH
T14442D716AD28A97B8CC7D61DFB157F23D2F95526A0D11E08A6FC8A1C14EB6DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8cd2c1e2438077012316513768246b0d14b14d659d611219ea1d2940fbf1f37b
MD5 e90db5eb784e98f58d8616ef7807703f
SHA1 c012b27b30e20333d00c85beab167ed5b6c1382b
SHA512 3df98f3f45eceaf1fb70374cf2ea39840b48f942cb83cfbf7ca9a64df43ceb46a4d48f13d8aa8411b63dfc26644e96dd4f2a1cb9cf545e09387dae2e92ba4740
SSDEEP 768:wb8d2g7pLuL7r6WgoufmM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmu46crohjx5d:wb8d2sE7r6WgoufmMu1jaJV6HvL
TLSH
T1EBC2EA7B740CCB7E4F800ADDE819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 ac2473fe3c0eecf560c1246a5ada3572c3fdc3ba3ab89a22cbdb2f7d75b5ee5c
MD5 f59575f1fa6edd94659fef874acda10a
SHA1 12b0d54111998fb590dc22cac89b152c6a93b816
SHA512 0e15209822575dd3e4969983beacf6433a7ba632a61b2b61a5cd71abe4e4a47a1b1c3ef6b075f43e576f95e416abb05575b9b96ad7b6a0363c9903af33706781
TLSH
T1F8E0269085C8C17D652526874628A30883E87607E7C8BF1A3FB1C8487A93685B29F181
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 eb923454097ff43c32324cd6df9d48ec455fd375e589c7f9d2a0ca9a92ac77da
MD5 b00265b63e19af23e06b5a0b40a26b67
SHA1 b58a92fbb498323ce7b1022c9c48ff862b19bad3
SHA512 e63a0c151eecceaee6531035c93017e63e1818bf7cc0972443503779b811f08dcf066e6bfe48d120104be1353fa974029f574b34de4822d20209598d990df934
TLSH
T144E092B095C9C63A624520C79314F709C3F27602D6CAEA153B18A485B647180B24F150
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 47111071f6f892b8092c1c20bb489a71e871453c0ef8cc535f14452e387f530a
MD5 4e37e7b23d741f7e00e10fb91bb077f0
SHA1 f221adb2d0666e998659fac2ed4b5b00ed7cf5f6
SHA512 228bd5a96efe943c8da5341e39af6e96a6e187c371036d02df10747b2ec36f74e53849194b4f571d4815a84d5a4eebc0c0aab1521b57ad56b82513b0d51fc241
TLSH
T167E086B0C5CDC639651860C38364B71EC3F47F0797CABA5A67188889F943155B6AF980
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6f4195f35b2e65bd50117a9c2535b9da587d6d2881ac4180b4c1d048d7f95d4e
MD5 8312cdbcc86ba0fdb4c485637554101f
SHA1 992aefa24a9673a3c90152ab8fba3c69d1072998
SHA512 34f624f12e7a00cc7a5e1e4a0486932eaae5ae5903c0de6b2d3fcfe92f430c09022445c1e6f0ec4496acfe425bc594645d803ad29ad8a6037dc79e76b8879e52
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbD9oQK1iK2N:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZO
TLSH
T17DA10516B2B71694393FB90C84A5881FC6C178A33119E52F3BE945A60F67E128CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a86b1dc4f6293c6b77d824d368dcec4f40624e1c8930ec948cb3c48d096aa982
MD5 0a0f2f406d0a4103080a1193f8f88598
SHA1 08a22ff543125efd88a638141a7ad92f12662cde
SHA512 d3eca7df06236569a9f4ce0188dbefb4aad1dd520a55ea299b92fd540918a654458d5c7859a39b23e2be841d75b1f2304fa67405c43dbc4e7b7f9181c31ec8f2
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbD9oQK1iK24:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZJ
TLSH
T10BA10516B1B61694393FB90C84A5891FC6C178A3311AE53F3BE945A60F67E128CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 2755b26bbb5d93f8251b5699e5936e38be2e79379e2f3410d6f0fede6ab56f86
MD5 0bb792573777d3071d347b90ef738a5a
SHA1 d0194a1e916c5020f543695846ac669720b5c5d3
SHA512 94e6c7f1d1d35b6b7f92fb57455be0d59f28614d5f1f29aa81d4bf012062c86deb3e7e2bc6261d28db3a7379dcf9409a37ab2940df76349a2f6289f3a7509193
SSDEEP 384:DNrRZyCSDnxTICR0MEhIKyll7svbFKfk7:xFZJSDniqFyI1l7svbF9
TLSH
T12E44950A7B747001EDE6DD721CB080771E3C716D8F22A6916DA254698DB3853A63D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 337B
SHA256 32cbe60b696ceb2d7ccfe4a4bbf4e8366ce33c333e6d18c4cd53683e8519199f
MD5 4113692c1fe1c74bdb090d1fab8bab4d
SHA1 98f30bb7b9c3cc720539cffaa0a2c8953f9300de
SHA512 9b517a2ff674a10d8a55f123e7be9d4a80111d12d2aabf9627f3ea05fd7c8a99eeb93b6d475779844427a6ada1af36bf66b77303cf394bb5ae265580931056b9
TLSH
T1A2E02091939730D47E4EDE50C1183C03D4C43DE3230F8472375D05944B4581A8D3D87E
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 497B
SHA256 ed947047eb92e83aa5570f5ff5af8471cac6bc52648cfc7a6d5b287328b190a5
MD5 54eea156d2a563e6828e5f03d4cf1456
SHA1 2df39b76709000b36740300b10a0016340415712
SHA512 e56fcc8a2f2ade67c9c1c1012359889eba33e961ac07db305c3cb421af66d403a43f27c929857fa3e0b8f70b4918d7f1a509c68c3018731ce3e32b3f9e130d66
TLSH
T1B6F0AECB6E030577CC02507150336783FF2189CB0024646703CD202B2A1D2F1C5CC0E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 1af0e65c90ca26f6db18916ace7bdfba8966e2bcc56d414b723e1667c79cd11f
MD5 e6517a6e999e1070291f8ab5665da7d6
SHA1 bbd7a39cc1c8b6e6e37c496ff37c7048f42e6f9f
SHA512 b1c0898a31b555e1b829d95e17048fdf497005e243b99fb036ee99bb8cc69f7d26e14321c3b37c4635128e5c8203a8f220b2337745ad6747bbed1282ade1f489
TLSH
T1F4E02610ECC8C37EA51524D75124B708C3C53B43FBC8B90A1F20C488B442321B68F181
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 c5e544d586ff2d72be03a442e0087a70dcab901bb7c45239f1121076e2f0b2c6
MD5 caaddcb91ed3685ee80efe23182c970f
SHA1 1841c9d4c2467c7be78913821752fe6f5bd91169
SHA512 dae0ce2be1bbc0ace2d2198b3df6c700b0f5680fff66276b8f59b5340f4392733a97375be71957fc6cc30bd97ac85e5e3e91417cf00bd7707ebd258126440869
TLSH
T13D219E55F330D118E54E923A60AE9B261338D8438FB8ED0F44B570652E72B542E8B2E6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 ba4567d6c47e1603345a410f87d19b1339695bce0fc4f43199ee435a3c06a9b6
MD5 c058734645fefebb59669b676d03564b
SHA1 9e09353dee64bc92cbf8f772f94d8280cc9bffad
SHA512 f150a00703e4ec48e05793e1f387a28c0524dfa9e9624be560ca3aa0cf9763f565e5dc1463bf1eb5a468a9430f313e9fa2aa10fa2c233cd1c5abf7985a4c5229
TLSH
T16BE0D810A4C4C26F621035C34168B34C82D53A07FBC5BE451F28C84C6A02346724F142
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5c9fc2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5c9fc2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 5ce4b70714a14d6edd3984aff6ffbf91500bc469237550e8fd2812a4b6ad0e23
MD5 c2cc02209692a818860bc7cca262985b
SHA1 eace9a5e211534271e6c46edbfb65dcd62031ffd
SHA512 ba7e89b94315fd7c09b67a6a9ad133e4c1b566da570f2096d931cc8263bac30d4f9ec28d491e3f20ed22b7bb5b71ab7037692a40d790e4a0d5292d02fde33f58
SSDEEP 3:MsEllllkEthXllkl2zEflxI/:/M/xT02z
TLSH
T1B2440404FFC0040DD50010304051C77033F0D4104535574334D30473DCC75400D74440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 9319a453c459bfe130c27749277bb17b6e06ca48999e91ed97badba972a4c84c
MD5 e0e3fa179d9a9e2d1c1aa98b7a29606c
SHA1 099ce220046b005d8a30592c9389ddc390a15145
SHA512 ee3c0d1e3e88e8ad601cca2a03cc27ab3b013e9892c2e153444ce9876a9fadcb7f4aa1ee7ac916c9f131d5840c06b5d14e85689b8c93f79fc12db5066c77dbdf
SSDEEP 3:MsEllllkEthXllkl2zEflWhEt:/M/xT02zb
TLSH
T1C0440204AF808549C9001430406183602370E45505115743289508229CC69C00C14010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
Size 120B
SHA256 9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
MD5 a397e5983d4a1619e36143b4d804b870
SHA1 aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA512 4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
TLSH
T1E0B012203BF9062CF3F74D00AA73AA3428BFF4080A14811D505102080C33E19C478FA3
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c0cc4d3095e477790b2a13459980f4f19220a3dc7e6d190b04f0bad5c2cf5504
MD5 ddc8ff9011cf68d9d145c3ad471204f1
SHA1 2d3473625c92c84f0c8fb5e766b7266c10b6a0db
SHA512 c944701f519897176192eed51a241ca1d3c9747eae2a11302c299d30323329b227c5a06e8d5f7d13695236e09f1ed02a9094afafbdaa8a4501adbe3b289c11d2
SSDEEP 768:6rv+4UNbds3JODZIO0ZQRONzc4ReyIsX3eVH1S5D:6bsbS3sOtc44bsnEH1Y
TLSH
T1DC03DF32E8688A77ECF6A686B14776537EF8912BC2D81E94C4DE1F0C464B5DD130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 300f227aee1e0ea539c21ae1433fbbdb731a1d9ec90c631bd1c8ae77296ddeec
MD5 602d3c40a64a34e5c65cdc74d870b86e
SHA1 1a0574c2d1d0a789f3fd5a6fd9b25c70d6a3e102
SHA512 910f17f64b353d4b700cc9d7200612cbad6b3a141a294a878efae2600911f562e538fcdb18c5232cf22fade2f505cbdcd30b337a76672522f0c10c50a80d053c
SSDEEP 768:333z32SDZFCO0ZQRjLNzc4ReyIsMkr9+HC49:333jnjLtc44bsDwx
TLSH
T1C7F29D35EC259D3B9CFAB742B50A3612ACF4813BC1E85D98D7DD5B0C85275ACA31BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f7b212d8dd72f0584e8786ccb0a143c801a5749dd620273e454087799c131c9f
MD5 74c712b9415879f32a14fc96c13729e5
SHA1 eabfaf407f2e14b09d38b572b629da80ee9a8910
SHA512 263f1a9778c6a27f7578ba832b33dae97b8a1d1a0e377f8681c7a6fca1f9317e9c60ed926a7f0f98b64c50d7cfdac82ab9d8070f7885eb78150e68eac9333b43
SSDEEP 768:vrv+4UNbds3s8DZIO0ZQRIWsDNzc4ReyIs2GeVH1S5D:vbsbS3rIWsDtc44bs5EH1Y
TLSH
T1A103CE32A868DD73ACFAA681F14736937EF8616B81C40E94C4DA5F0C4A4B1DD175F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 59KB
SHA256 05882d819fc5564eea755c27f3e839da9b69d221e200df0b7d6a1d6da851e066
MD5 c62aca213a2bead0bd59e332d02d241d
SHA1 b9eb56e904e124be9a7012ad0060f0e7222dcdd9
SHA512 4db9a093aed73547058d40b5c922d442a5ea51ac38cea5613982b6bf42271970e1ec93ee1d76761a85f71aed87c8d27d97403cc0e9cfc2e3f0a5a30bf4c8fa61
SSDEEP 768:iqFg33vwgD3/7ZwUNzc4ReyIsUKTOOGwh9UiwzI+0oC0Cc9Xn9kr9+HQa49:W33tBtc44bsUKTbh3cIVaCc1ywC
TLSH
T150536BF99CC3893AE9AE6743A73D2C065DBCD527B1A85884F7981E0CDC665BFD306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b563f460cd8abe5b673bebc1b39692653350dc37ec13d70874f13faca24c2596
MD5 16292fef4af371ebe25d17358fa9c2e1
SHA1 5dc7344828759ff4e83f351a0a680bcb4cd8ba2c
SHA512 2000c4a120a665966949d8a8960ae77b56be205300a2a42bcca7f08563a7977de45228be7fed9b7f1633bfc527c5e85b7e4656709f4ced7d7a4358e9091097c8
SSDEEP 768:033z32SDZIO0ZQRIWs1Nzc4ReyIsMGM49:033jTIWs1tc44bsLP
TLSH
T1FDE2BE31AC69DD73ACFAAA02F9073683AEF4A12B81D41E84D5D99F0C05476ED172F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a99b6ec2ff6267221b275b5a9a6eb0653ee3e84bbcc38c9de27cc5b083c39bd8
MD5 6da859db079367fdd10ed705efd95b30
SHA1 184517168e534063d5c1258daeb5bc3d8c801ebf
SHA512 118f5fcf53d023b2eea5a241effac8b20444f9225ebd72ae7e862413557bdf2105f9fa491abbf307c3488c134955961775aa3917f4f0804b709ee1b6fcc7547f
SSDEEP 768:s33I32SDZIO0ZQRIWs1Nzc4ReyIsMGM49:s33YTIWs1tc44bsLP
TLSH
T119E2BE31AC69DC73ACFAAA02F9073683AEF4A12B81D41E84D5D99F0C05476ED172B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8143ab80e008577e7aa9dabb4698dd9cc8e28d527b6e640e452877d9f8ada42b
MD5 1a9086cd213bd7f3c990bca00c326f5f
SHA1 0e2c069361f83052e53165ff349c7f28b43bebe0
SHA512 d15973a6d92cfe48a09a60e49c7c80f19ff1b58aca2da2bf610a21ca2ec46416ffe4b349ccade3212ed8698daed8836c6e605787e0b93edcf391a8b2300686bc
SSDEEP 768:crv+4UNbds3C9SDZIO0ZQRIWsLNzc4ReyIsPo+9N8M4u:cbsbS3CoIWsLtc44bsg28I
TLSH
T1AA137C3DAC28997F9CAEBB05B10E2A677EB8513BC1B019A8C7D51B0CC53749DF356812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
MD5 6fffbb37a25451ca0fd1ce8b982bd702
SHA1 ee40866929229bc347edfc804e39a3c5cc43adb8
SHA512 12428583e6d01cb824604849c36a07a1e8fa4e989833b90dfc76b8ca17621c72308867209d2c01fca5956783d24393968b7668b119a1b1b6b86c4bfd4ec73707
SSDEEP 3:MsEllllkEthXllkl2zEfly:/M/xT02z
TLSH
T14B44040C7FC11CCDC50034304451C37033F4F4500511574335D10573DCCF5400C10000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db
Size 48KB
SHA256 98a55546e41fe03178af27446c0389ccc2781038f0b7348d2ad50846dc33f5dc
MD5 ed12c620433363f3bae135c5d15dca2f
SHA1 5414b1db440c59cc15f8847894da1f79ac9843e7
SHA512 3da4b07665fb714d7203dfd8512ceff56b29f2a6e7cb17d602a3dee21969cfb4a20236fc1605374054268d634d1412a3887a4a76a931bda931eb469c22b04b75
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfLe:TY/IHRH34kWqB1kQnjhHmr6ITmU9Le
TLSH
T10323886EDA2CA9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db-journal

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal
Size 12KB
SHA256 9c4c6ab3b8baf231c8ce569edca0227c1ffa7f568b0b85256b3afe6e6a2d3cdb
MD5 ff3d3f7cc398553b9687de907a86a2c0
SHA1 fd2e2ddcd197dcdaf1497582271e04a8ee6e98d5
SHA512 c6e1d60cd6ade5602d5e80a25026e5ca0928233d4413c26067482f12039bf3c2d378d036dd259e62bb9a0c5851ec57beb387d55e77d3fd0d562d53bd5dab96e5
SSDEEP 24:A+Wi+f+qL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6Uw48:/o+qY/IHRH34kWqB1kQnjhHmr6ITmUW
TLSH
T10242786EDA2CAEA2FEE00B3ED7D1D0127B35A60EC2E4D9F2095B505747C444405DB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78d98bba-f121-4c66-bc68-90ba0ce837ad.tmp

Path C:\Users\Admin\AppData\Local\Temp\78d98bba-f121-4c66-bc68-90ba0ce837ad.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zyntheria spoofer.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO862E0529\zyntheria spoofer.bat
Size 7KB
SHA256 dbd1dfa4b1bb8a70337ae709c9593bb7d950ac9e7d48b50dc86ab30f065eb6f7
MD5 30f632fb7c4ec76bba0e2b93f0b3dfb8
SHA1 b1f742146ff99dd89aa0c700ab671d744dca5717
SHA512 6fec683168b30b40115a357e74e5ab9e84c5109e857f2ab14d3c3b1d352f40db815a5259a015774281231e44ed27aad0f63588e59b689ae84dd51eb27b366efd
SSDEEP 192:CkOFl54EY61EcGy98V8n6SJaRaOna80jaMJ60q7:CxFl5bE8CSJYnn10jo
TLSH
T190E162F33461CC2268D5A7639CA0A19536D883C704192ECE715F5230A796FC47AFEBE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

baa84d18-a964-4500-8e3d-cc29c8c5375e.tmp

Path C:\Users\Admin\AppData\Local\Temp\baa84d18-a964-4500-8e3d-cc29c8c5375e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 1KB
SHA256 cb7ab2098235766f952a703051e1d7ca917175a90792f6130ba364cf8f30d891
MD5 121374c1a8e9a8f219823d6b30ab77d8
SHA1 2ec56b3d3ca54b377797332eba96aa54fbb50d5d
SHA512 ac96d7a9bdad4095509ab85c54570330e19cb88e35d357e672ddeaf91ba3a7adec62e5eeb32569b5b14565c34e4f5c009bad9ae54463a9fe15f4bfe659d5e65d
TLSH
T1F921F8913536337B06C247E4E0764CC5A950F995533F1A9CE91A6474FE2CED1A32D3CA
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2992_47182058\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads