7bdf3cfcd458fe5de706dceb5873343046e481233abe9f60ea63633d788027ad

Analysis

max time kernel
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SAK CLEANER/1- Cleaner.bat
Size 1KB
Sample260905-cpmv2a11dy
SHA256 7bdf3cfcd458fe5de706dceb5873343046e481233abe9f60ea63633d788027ad
MD5 f3a60b82f758ea4e7ecb9ca473c1e99d
SHA1 5393702183f27e9efbfd9434ba05b8449b36bfe8
SHA512 f943e5674a2c7e611d60fd32a1a34886cbe3a61f44037cc504d27570c3d67ab2af74461441e1eb1bf67ac17c784e16d35dd3770f654efbc80e2278697ca3beff
TLSH
T17511F01420498A1733F39D74CB123158F69FF287791C89B1F062A4949EA93C5DDEEDE4
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
996	wevtutil.exe
4184	wevtutil.exe
5060	Process not Found
6064	wevtutil.exe
4848	wevtutil.exe
5104	wevtutil.exe
5924	wevtutil.exe
2560	wevtutil.exe
5196	wevtutil.exe
1392	wevtutil.exe
2996	wevtutil.exe
4328	wevtutil.exe
5460	wevtutil.exe
4424	wevtutil.exe
4752	wevtutil.exe
4160	wevtutil.exe
2952	wevtutil.exe
2828	wevtutil.exe
2656	wevtutil.exe
3600	wevtutil.exe
4272	wevtutil.exe
3344	wevtutil.exe
1748	wevtutil.exe
4312	wevtutil.exe
5180	wevtutil.exe
872	wevtutil.exe
3928	wevtutil.exe
4424	wevtutil.exe
4076	wevtutil.exe
4184	wevtutil.exe
5000	wevtutil.exe
3144	wevtutil.exe
1788	wevtutil.exe
4788	wevtutil.exe
4388	wevtutil.exe
1616	wevtutil.exe
3032	wevtutil.exe
3532	wevtutil.exe
2016	wevtutil.exe
3616	wevtutil.exe
2184	Process not Found
1528	wevtutil.exe
5760	wevtutil.exe
1552	wevtutil.exe
4772	wevtutil.exe
3600	wevtutil.exe
248	wevtutil.exe
3068	wevtutil.exe
1540	Process not Found
3600	wevtutil.exe
5620	wevtutil.exe
2304	wevtutil.exe
3564	wevtutil.exe
988	wevtutil.exe
5196	wevtutil.exe
4492	wevtutil.exe
2144	wevtutil.exe
4084	wevtutil.exe
4388	Process not Found
4976	wevtutil.exe
5184	wevtutil.exe
3120	wevtutil.exe
5724	wevtutil.exe
2720	wevtutil.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5920	wevtutil.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4408	cmd.exe
1132	cmd.exe
4428	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4348	wevtutil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2292	wevtutil.exe
Token: SeBackupPrivilege	2292	wevtutil.exe
Token: SeSecurityPrivilege	4884	wevtutil.exe
Token: SeBackupPrivilege	4884	wevtutil.exe
Token: SeSecurityPrivilege	5096	wevtutil.exe
Token: SeBackupPrivilege	5096	wevtutil.exe
Token: SeSecurityPrivilege	3560	wevtutil.exe
Token: SeBackupPrivilege	3560	wevtutil.exe
Token: SeSecurityPrivilege	5800	wevtutil.exe
Token: SeBackupPrivilege	5800	wevtutil.exe
Token: SeSecurityPrivilege	1992	wevtutil.exe
Token: SeBackupPrivilege	1992	wevtutil.exe
Token: SeSecurityPrivilege	4324	wevtutil.exe
Token: SeBackupPrivilege	4324	wevtutil.exe
Token: SeSecurityPrivilege	5312	wevtutil.exe
Token: SeBackupPrivilege	5312	wevtutil.exe
Token: SeSecurityPrivilege	3416	wevtutil.exe
Token: SeBackupPrivilege	3416	wevtutil.exe
Token: SeSecurityPrivilege	1788	wevtutil.exe
Token: SeBackupPrivilege	1788	wevtutil.exe
Token: SeSecurityPrivilege	2776	wevtutil.exe
Token: SeBackupPrivilege	2776	wevtutil.exe
Token: SeSecurityPrivilege	204	wevtutil.exe
Token: SeBackupPrivilege	204	wevtutil.exe
Token: SeSecurityPrivilege	264	wevtutil.exe
Token: SeBackupPrivilege	264	wevtutil.exe
Token: SeSecurityPrivilege	5816	wevtutil.exe
Token: SeBackupPrivilege	5816	wevtutil.exe
Token: SeSecurityPrivilege	120	wevtutil.exe
Token: SeBackupPrivilege	120	wevtutil.exe
Token: SeSecurityPrivilege	4104	wevtutil.exe
Token: SeBackupPrivilege	4104	wevtutil.exe
Token: SeSecurityPrivilege	2928	wevtutil.exe
Token: SeBackupPrivilege	2928	wevtutil.exe
Token: SeSecurityPrivilege	6056	wevtutil.exe
Token: SeBackupPrivilege	6056	wevtutil.exe
Token: SeSecurityPrivilege	4132	wevtutil.exe
Token: SeBackupPrivilege	4132	wevtutil.exe
Token: SeSecurityPrivilege	5492	wevtutil.exe
Token: SeBackupPrivilege	5492	wevtutil.exe
Token: SeSecurityPrivilege	6048	wevtutil.exe
Token: SeBackupPrivilege	6048	wevtutil.exe
Token: SeSecurityPrivilege	4336	wevtutil.exe
Token: SeBackupPrivilege	4336	wevtutil.exe
Token: SeSecurityPrivilege	2336	wevtutil.exe
Token: SeBackupPrivilege	2336	wevtutil.exe
Token: SeSecurityPrivilege	4544	wevtutil.exe
Token: SeBackupPrivilege	4544	wevtutil.exe
Token: SeSecurityPrivilege	1504	wevtutil.exe
Token: SeBackupPrivilege	1504	wevtutil.exe
Token: SeSecurityPrivilege	2768	wevtutil.exe
Token: SeBackupPrivilege	2768	wevtutil.exe
Token: SeSecurityPrivilege	1724	wevtutil.exe
Token: SeBackupPrivilege	1724	wevtutil.exe
Token: SeSecurityPrivilege	4424	wevtutil.exe
Token: SeBackupPrivilege	4424	wevtutil.exe
Token: SeSecurityPrivilege	3556	wevtutil.exe
Token: SeBackupPrivilege	3556	wevtutil.exe
Token: SeSecurityPrivilege	236	wevtutil.exe
Token: SeBackupPrivilege	236	wevtutil.exe
Token: SeSecurityPrivilege	4492	wevtutil.exe
Token: SeBackupPrivilege	4492	wevtutil.exe
Token: SeSecurityPrivilege	2828	wevtutil.exe
Token: SeBackupPrivilege	2828	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 2164	4408	cmd.exe	90
PID 4408 wrote to memory of 1132	4408	cmd.exe	91
PID 1132 wrote to memory of 6000	1132	cmd.exe	92
PID 4408 wrote to memory of 4428	4408	cmd.exe	93
PID 4428 wrote to memory of 2292	4428	cmd.exe	94
PID 4408 wrote to memory of 4884	4408	cmd.exe	95
PID 4408 wrote to memory of 5096	4408	cmd.exe	96
PID 4408 wrote to memory of 3560	4408	cmd.exe	97
PID 4408 wrote to memory of 5800	4408	cmd.exe	98
PID 4408 wrote to memory of 1992	4408	cmd.exe	99
PID 4408 wrote to memory of 4324	4408	cmd.exe	100
PID 4408 wrote to memory of 5312	4408	cmd.exe	101
PID 4408 wrote to memory of 3416	4408	cmd.exe	102
PID 4408 wrote to memory of 1788	4408	cmd.exe	103
PID 4408 wrote to memory of 2776	4408	cmd.exe	104
PID 4408 wrote to memory of 204	4408	cmd.exe	105
PID 4408 wrote to memory of 264	4408	cmd.exe	106
PID 4408 wrote to memory of 5816	4408	cmd.exe	107
PID 4408 wrote to memory of 120	4408	cmd.exe	108
PID 4408 wrote to memory of 4104	4408	cmd.exe	109
PID 4408 wrote to memory of 2928	4408	cmd.exe	110
PID 4408 wrote to memory of 6056	4408	cmd.exe	111
PID 4408 wrote to memory of 4132	4408	cmd.exe	112
PID 4408 wrote to memory of 5492	4408	cmd.exe	113
PID 4408 wrote to memory of 6048	4408	cmd.exe	114
PID 4408 wrote to memory of 4336	4408	cmd.exe	115
PID 4408 wrote to memory of 2336	4408	cmd.exe	116
PID 4408 wrote to memory of 4544	4408	cmd.exe	117
PID 4408 wrote to memory of 1504	4408	cmd.exe	118
PID 4408 wrote to memory of 2768	4408	cmd.exe	119
PID 4408 wrote to memory of 1724	4408	cmd.exe	120
PID 4408 wrote to memory of 4424	4408	cmd.exe	121
PID 4408 wrote to memory of 3556	4408	cmd.exe	122
PID 4408 wrote to memory of 236	4408	cmd.exe	123
PID 4408 wrote to memory of 4492	4408	cmd.exe	124
PID 4408 wrote to memory of 2828	4408	cmd.exe	125
PID 4408 wrote to memory of 4180	4408	cmd.exe	126
PID 4408 wrote to memory of 5064	4408	cmd.exe	127
PID 4408 wrote to memory of 6064	4408	cmd.exe	128
PID 4408 wrote to memory of 2612	4408	cmd.exe	129
PID 4408 wrote to memory of 1460	4408	cmd.exe	130
PID 4408 wrote to memory of 472	4408	cmd.exe	131
PID 4408 wrote to memory of 3544	4408	cmd.exe	132
PID 4408 wrote to memory of 5404	4408	cmd.exe	133
PID 4408 wrote to memory of 5012	4408	cmd.exe	134
PID 4408 wrote to memory of 2844	4408	cmd.exe	135
PID 4408 wrote to memory of 772	4408	cmd.exe	136
PID 4408 wrote to memory of 2072	4408	cmd.exe	137
PID 4408 wrote to memory of 1940	4408	cmd.exe	138
PID 4408 wrote to memory of 296	4408	cmd.exe	139
PID 4408 wrote to memory of 5924	4408	cmd.exe	140
PID 4408 wrote to memory of 2888	4408	cmd.exe	141
PID 4408 wrote to memory of 2016	4408	cmd.exe	142
PID 4408 wrote to memory of 5824	4408	cmd.exe	143
PID 4408 wrote to memory of 2228	4408	cmd.exe	144
PID 4408 wrote to memory of 1428	4408	cmd.exe	145
PID 4408 wrote to memory of 3120	4408	cmd.exe	146
PID 4408 wrote to memory of 4584	4408	cmd.exe	147
PID 4408 wrote to memory of 2268	4408	cmd.exe	148
PID 4408 wrote to memory of 1164	4408	cmd.exe	149
PID 4408 wrote to memory of 2408	4408	cmd.exe	150
PID 4408 wrote to memory of 2932	4408	cmd.exe	151
PID 4408 wrote to memory of 616	4408	cmd.exe	152
PID 4408 wrote to memory of 704	4408	cmd.exe	153

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SAK CLEANER\1- Cleaner.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\bcdedit.exe
    bcdedit
    3⤵
    PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wevtutil.exe el
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\wevtutil.exe
    wevtutil.exe el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "AMSI/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "AirSpaceChannel"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Application"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "DirectShowFilterGraph"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "DirectShowPluginControl"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Els_Hyphenation/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "EndpointMapper"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "FirstUXPerf-Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "ForwardedEvents"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "General Logging"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "HardwareEvents"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "IHM_DebugChannel"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS-GPIO/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS-I2C/Analytic"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-GPIO2/Performance"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-I2C/Debug"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Intel-iaLPSS2-I2C/Performance"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Internet Explorer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Key Management Service"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_DshowReverseBridge"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationDeviceMFT"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MF_MediaFoundationFrameServer"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MedaFoundationVideoProc"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MedaFoundationVideoProcD3D"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationAsyncWrapper"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationContentProtection"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationDS"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationDeviceProxy"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationMP4"
  2⤵
  PID:4180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationMediaEngine"
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPerformance"
  2⤵
  PID:6064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPerformanceCore"
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPipeline"
  2⤵
  PID:1460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationPlatform"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "MediaFoundationSrcPrefetch"
  2⤵
  PID:3544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client-Streamingux/Debug"
  2⤵
  PID:5404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Admin"
  2⤵
  PID:5012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Debug"
  2⤵
  PID:2844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Operational"
  2⤵
  PID:772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-Client/Virtual Applications"
  2⤵
  PID:2072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-AppV-SharedPerformance/Analytic"
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-License-Flexible-Platform/Admin"
  2⤵
  PID:296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-License-Flexible-Platform/Debug"
  2⤵
  PID:5924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-License-Flexible-Platform/Diagnostic"
  2⤵
  PID:2888
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Admin"
  2⤵
  PID:2016
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Debug"
  2⤵
  PID:5824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Client-Licensing-Platform/Diagnostic"
  2⤵
  PID:2228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-IE/Diagnostic"
  2⤵
  PID:1428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
  2⤵
  PID:3120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
  2⤵
  PID:4584
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-OneCore-Setup/Analytic"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
  2⤵
  PID:1164
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"
  2⤵
  PID:2932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Admin/Debug"
  2⤵
  PID:616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
  2⤵
  PID:704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
  2⤵
  PID:5516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
  2⤵
  PID:1420
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Debug"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-App Agent/Operational"
  2⤵
  PID:2796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-IPC/Operational"
  2⤵
  PID:6044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
  2⤵
  PID:360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AAD/Analytic"
  2⤵
  - Clears Windows event logs
  PID:4752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AAD/Operational"
  2⤵
  PID:768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
  2⤵
  PID:4308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ASN1/Operational"
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
  2⤵
  PID:2572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
  2⤵
  PID:3860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AccelLib-AccelCx/Operational"
  2⤵
  PID:5500
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-All-User-Install-Agent/Admin"
  2⤵
  PID:4932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Admin"
  2⤵
  PID:1148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/ApplicationTracing"
  2⤵
  PID:5300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Diagnostic"
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppHost/Internal"
  2⤵
  PID:3320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
  2⤵
  PID:5992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
  2⤵
  PID:4852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppLocker/Verbose"
  2⤵
  PID:5444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Admin"
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Analytic"
  2⤵
  - Clears Windows event logs
  PID:1528
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Debug"
  2⤵
  PID:4464
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
  2⤵
  PID:1220
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-State/Debug"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppModel-State/Diagnostic"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Admin"
  2⤵
  PID:1000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Debug"
  2⤵
  PID:5928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppReadiness/Operational"
  2⤵
  PID:5116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppSruProv"
  2⤵
  PID:4628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Diagnostic"
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeployment/Operational"
  2⤵
  PID:1980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Debug"
  2⤵
  - Clears Windows event logs
  PID:3928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Operational"
  2⤵
  PID:3184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
  2⤵
  PID:3196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
  2⤵
  - Clears Windows event logs
  PID:3032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ApplicabilityEngine/Operational"
  2⤵
  PID:5236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
  2⤵
  PID:1276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
  2⤵
  PID:2972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
  2⤵
  PID:3600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
  2⤵
  PID:3552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
  2⤵
  PID:5844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
  2⤵
  PID:4612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
  2⤵
  PID:4832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Debug"
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Operational"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AppxPackaging/Performance"
  2⤵
  - Clears Windows event logs
  PID:4160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Admin"
  2⤵
  PID:3256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccess/Operational"
  2⤵
  - Clears Windows event logs
  PID:2952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Admin"
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AssignedAccessBroker/Operational"
  2⤵
  PID:4680
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AsynchronousCausality/Causality"
  2⤵
  PID:6080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/GlitchDetection"
  2⤵
  PID:2128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Informational"
  2⤵
  PID:5620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
  2⤵
  PID:4724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
  2⤵
  PID:6124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audio/PlaybackManager"
  2⤵
  PID:5680
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
  2⤵
  PID:688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
  2⤵
  PID:1708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
  2⤵
  PID:2164
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
  2⤵
  PID:6000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
  2⤵
  PID:2544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
  2⤵
  - Clears Windows event logs
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/HCI"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
  2⤵
  PID:5800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BTH-BTHUSB/Performance"
  2⤵
  PID:1992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
  2⤵
  PID:4324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
  2⤵
  PID:5312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
  2⤵
  PID:3416
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Backup"
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Battery/Diagnostic"
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Biometrics/Analytic"
  2⤵
  PID:6056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
  2⤵
  PID:5492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
  2⤵
  PID:6048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Management"
  2⤵
  PID:2336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/BitLocker Operational"
  2⤵
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BitLocker/Tracing"
  2⤵
  PID:1504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
  2⤵
  PID:1724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
  2⤵
  - Clears Windows event logs
  PID:4424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
  2⤵
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Bluetooth-Policy/Operational"
  2⤵
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
  2⤵
  - Clears Windows event logs
  PID:2828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
  2⤵
  PID:4180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
  2⤵
  - Clears Windows event logs
  PID:6064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
  2⤵
  PID:1460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
  2⤵
  PID:2744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
  2⤵
  PID:2756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ApartmentInitialize"
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ApartmentUninitialize"
  2⤵
  PID:5616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/Call"
  2⤵
  PID:5960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/CreateInstance"
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/ExtensionCatalog"
  2⤵
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/FreeUnusedLibrary"
  2⤵
  PID:5708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COM/RundownInstrumentation"
  2⤵
  PID:5504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/Activations"
  2⤵
  PID:1696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/MessageProcessing"
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Calculator/Debug"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"
  2⤵
  PID:3460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
  2⤵
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
  2⤵
  PID:3652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Cleanmgr/Diagnostic"
  2⤵
  PID:4140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudFiles-Filter/Debug"
  2⤵
  - Clears Windows event logs
  PID:5760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudFiles-Filter/Operational"
  2⤵
  - Clears Windows event logs
  PID:3532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudRestoreLauncher/Operational"
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Debug"
  2⤵
  - Clears Windows event logs
  PID:4848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Initialization"
  2⤵
  PID:2560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CloudStore/Operational"
  2⤵
  PID:4856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
  2⤵
  PID:5180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
  2⤵
  PID:2352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
  2⤵
  - Clears Windows event logs
  PID:5724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
  2⤵
  PID:2988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
  2⤵
  PID:1596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Analytic"
  2⤵
  PID:5540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Compat-Appraiser/Operational"
  2⤵
  PID:4788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Debug"
  2⤵
  PID:5136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-BindFlt/Operational"
  2⤵
  PID:2520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Debug"
  2⤵
  PID:3112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Containers-Wcifs/Operational"
  2⤵
  PID:5900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Diagnostic"
  2⤵
  PID:5852
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Operational"
  2⤵
  PID:2420
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreApplication/Tracing"
  2⤵
  PID:1616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
  2⤵
  PID:4768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreWindow/Analytic"
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CoreWindow/Debug"
  2⤵
  - Clears Windows event logs
  PID:4976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
  2⤵
  PID:2580
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crashdump/Analytic"
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crashdump/Operational"
  2⤵
  PID:1752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
  2⤵
  PID:5808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
  2⤵
  PID:4896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-CNG/Analytic"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
  2⤵
  PID:4748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Debug"
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DPAPI/Operational"
  2⤵
  PID:3348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/CertInUse"
  2⤵
  PID:1312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/KeyMgmt"
  2⤵
  PID:2592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-NCrypt/Operational"
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
  2⤵
  PID:1264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
  2⤵
  PID:3296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Analytic"
  2⤵
  PID:2636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DAL-Provider/Operational"
  2⤵
  PID:5424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
  2⤵
  PID:2944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DDisplay/Analytic"
  2⤵
  PID:3568
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DDisplay/Logging"
  2⤵
  PID:5876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DLNA-Namespace/Analytic"
  2⤵
  PID:1956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Admin"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Analytic"
  2⤵
  PID:3552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Debug"
  2⤵
  PID:3768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DSC/Operational"
  2⤵
  PID:5844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:2720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
  2⤵
  PID:1388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
  2⤵
  PID:5388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Data-Pdf/Debug"
  2⤵
  PID:3388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/Admin"
  2⤵
  PID:2288
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
  2⤵
  PID:4160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
  2⤵
  PID:2760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
  2⤵
  PID:5596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Diagnostic"
  2⤵
  PID:5780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Operational"
  2⤵
  PID:3176
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Performance"
  2⤵
  PID:3844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deduplication/Scrubbing"
  2⤵
  PID:6120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Defrag-Core/Debug"
  2⤵
  PID:4700
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
  2⤵
  PID:5196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
  2⤵
  PID:2576
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceAssociationService/Performance"
  2⤵
  PID:5672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceConfidence/Analytic"
  2⤵
  PID:2124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Operational"
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceGuard/Verbose"
  2⤵
  PID:4272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Admin"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Analytic"
  2⤵
  PID:5800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Debug"
  2⤵
  PID:1992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSetupManager/Operational"
  2⤵
  PID:4324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
  2⤵
  PID:5312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
  2⤵
  PID:3416
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
  2⤵
  - Clears Windows event logs
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
  2⤵
  PID:2776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Devices-Background/Operational"
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Devices-Query/Performance"
  2⤵
  PID:5004
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
  2⤵
  PID:1128
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
  2⤵
  PID:5888
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
  2⤵
  PID:3480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
  2⤵
  PID:3188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
  2⤵
  PID:5916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
  2⤵
  PID:4244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
  2⤵
  PID:4560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
  2⤵
  PID:5148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
  2⤵
  PID:5864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
  2⤵
  PID:5336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
  2⤵
  PID:4276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
  2⤵
  PID:4064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
  2⤵
  PID:4796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
  2⤵
  PID:1460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
  2⤵
  PID:2492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
  2⤵
  PID:2756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
  2⤵
  PID:5616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
  2⤵
  PID:2072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
  2⤵
  PID:1940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
  2⤵
  PID:1672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
  2⤵
  PID:2608
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
  2⤵
  - Clears Windows event logs
  PID:2016
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
  2⤵
  PID:3460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
  2⤵
  PID:4928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
  2⤵
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
  2⤵
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/Analytic"
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/Logging"
  2⤵
  PID:2924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D12/PerfTiming"
  2⤵
  PID:4284
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3D9/Analytic"
  2⤵
  PID:4716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Direct3DShaderCache/Default"
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectComposition/Diagnostic"
  2⤵
  PID:2644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectManipulation/Diagnostic"
  2⤵
  PID:2692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
  2⤵
  PID:2796
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
  2⤵
  PID:360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
  2⤵
  PID:2988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
  2⤵
  PID:1596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/Analytic"
  2⤵
  PID:5540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
  2⤵
  - Clears Windows event logs
  PID:4788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
  2⤵
  PID:5136
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dism-Cli/Analytic"
  2⤵
  PID:3860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
  2⤵
  PID:3112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
  2⤵
  PID:5900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
  2⤵
  PID:2132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
  2⤵
  PID:1616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverProxy/Operational"
  2⤵
  - Clears Windows event logs
  PID:4388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DriverProxy/Performance"
  2⤵
  PID:1352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-API/Diagnostic"
  2⤵
  PID:3656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Compositor/Diagnostic"
  2⤵
  PID:5208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Core/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:4076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
  2⤵
  PID:6036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
  2⤵
  PID:3012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Admin"
  2⤵
  PID:832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-Operational"
  2⤵
  PID:3404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-SysMm/Debug"
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl-SysMm/Performance"
  2⤵
  PID:4168
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Contention"
  2⤵
  PID:4360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
  2⤵
  PID:1312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Power"
  2⤵
  PID:2592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Application-Learning/Admin"
  2⤵
  PID:1264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
  2⤵
  PID:4352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
  2⤵
  PID:4252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EFS/Operational"
  2⤵
  PID:3184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ESE/IODiagnose"
  2⤵
  PID:3196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ESE/Operational"
  2⤵
  PID:3032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
  2⤵
  PID:5236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
  2⤵
  PID:1276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
  2⤵
  PID:2820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-RasChap/Operational"
  2⤵
  - Clears Windows event logs
  PID:3600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-RasTls/Operational"
  2⤵
  PID:5612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-Sim/Operational"
  2⤵
  PID:3692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EapMethods-Ttls/Operational"
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
  2⤵
  PID:1676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorClass/Operational"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
  2⤵
  PID:5732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
  2⤵
  PID:3256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
  2⤵
  - Clears Windows event logs
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Operational"
  2⤵
  PID:6080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
  2⤵
  PID:2664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Analytic"
  2⤵
  PID:1236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FeatureConfiguration/Operational"
  2⤵
  - Clears Windows event logs
  PID:5620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
  2⤵
  PID:5660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
  2⤵
  PID:5196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Catalog/Debug"
  2⤵
  PID:2576
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
  2⤵
  PID:5672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
  2⤵
  PID:2124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Analytic"
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/Debug"
  2⤵
  - Clears Windows event logs
  PID:4272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Core/WHC"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Analytic"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Engine/Debug"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-EventListener/Debug"
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Analytic"
  2⤵
  PID:1748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-Service/Debug"
  2⤵
  PID:5764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
  2⤵
  PID:244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
  2⤵
  PID:52
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
  2⤵
  PID:4620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
  2⤵
  PID:4472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
  2⤵
  PID:3880
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
  2⤵
  PID:3248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
  2⤵
  PID:5492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GenericRoaming/Admin"
  2⤵
  PID:860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
  2⤵
  PID:2516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
  2⤵
  PID:4412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
  2⤵
  PID:5052
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
  2⤵
  PID:4560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Debug"
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HelloForBusiness/Operational"
  2⤵
  PID:5148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Help/Operational"
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
  2⤵
  PID:400
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
  2⤵
  PID:1272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Analytic"
  2⤵
  PID:5104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HotspotAuth/Operational"
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HttpService/Log"
  2⤵
  - Clears Windows event logs
  PID:2304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
  2⤵
  PID:2060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
  2⤵
  PID:4596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
  2⤵
  PID:2844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
  2⤵
  PID:772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
  2⤵
  PID:1792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-KMCL-Child/Analytic"
  2⤵
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
  2⤵
  PID:5924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Admin"
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Hyper-V-VID-Analytic"
  2⤵
  - Clears Windows event logs
  PID:4184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IE-SmartScreen"
  2⤵
  PID:3812
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-Broker/Analytic"
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CandidateUI/Analytic"
  2⤵
  PID:788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
  2⤵
  PID:4140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPAPI/Analytic"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPLMP/Analytic"
  2⤵
  PID:5760
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPPRED/Analytic"
  2⤵
  PID:3532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPSetting/Analytic"
  2⤵
  PID:4340
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-JPTIP/Analytic"
  2⤵
  PID:4848
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-KRAPI/Analytic"
  2⤵
  PID:4556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-KRTIP/Analytic"
  2⤵
  PID:6044
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
  2⤵
  - Clears Windows event logs
  PID:5180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TCCORE/Analytic"
  2⤵
  PID:2748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TCTIP/Analytic"
  2⤵
  PID:360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IME-TIP/Analytic"
  2⤵
  PID:5156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPNAT/Diagnostic"
  2⤵
  PID:4112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
  2⤵
  PID:4688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Debug"
  2⤵
  PID:4316
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IPxlatCfg/Operational"
  2⤵
  PID:1540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IdCtrls/Analytic"
  2⤵
  PID:2468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IdCtrls/Operational"
  2⤵
  PID:5260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
  2⤵
  PID:2896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
  2⤵
  PID:3252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-InputSwitch/Diagnostic"
  2⤵
  PID:3384
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
  2⤵
  PID:3592
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
  2⤵
  PID:4768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
  2⤵
  PID:3320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
  2⤵
  PID:5856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KdsSvc/Operational"
  2⤵
  PID:2580
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational"
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance"
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kerberos/Operational"
  2⤵
  PID:1752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
  2⤵
  PID:5808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/General"
  2⤵
  PID:4896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-AppCompat/Performance"
  2⤵
  PID:4836
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
  2⤵
  PID:4748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
  2⤵
  PID:4068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Operational"
  2⤵
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-CPU-Partition/Analytic"
  2⤵
  PID:3200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-CPU-Starvation/Operational"
  2⤵
  PID:4660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Cache/Operational"
  2⤵
  PID:3296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Dump/Operational"
  2⤵
  PID:6068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
  2⤵
  PID:3068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
  2⤵
  PID:3220
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
  2⤵
  PID:3568
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-IO/Operational"
  2⤵
  PID:2184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:3344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
  2⤵
  PID:5164
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-LiveDump/Operational"
  2⤵
  PID:3552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
  2⤵
  PID:3048
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PRM/Operational"
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
  2⤵
  PID:5732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Device Management"
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
  2⤵
  PID:3256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
  2⤵
  PID:5720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
  2⤵
  PID:3844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Performance"
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
  2⤵
  PID:5704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
  2⤵
  PID:5660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
  2⤵
  - Clears Windows event logs
  PID:5196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
  2⤵
  PID:2576
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
  2⤵
  PID:5672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
  2⤵
  PID:2124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
  2⤵
  PID:5000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
  2⤵
  PID:6040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
  2⤵
  PID:3108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Kernel-XDV/Analytic"
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Admin"
  2⤵
  PID:1392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Operational"
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-KeyboardFilter/Performance"
  2⤵
  PID:5920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
  2⤵
  PID:3000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LAPS/Operational"
  2⤵
  PID:3332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Diagnostic"
  2⤵
  PID:4268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Operational"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LSA/Performance"
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
  2⤵
  PID:4820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
  2⤵
  PID:4292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
  2⤵
  PID:4744
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
  2⤵
  PID:860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LimitsManagement/Diagnostic"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
  2⤵
  PID:2516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
  2⤵
  PID:4412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LiveId/Analytic"
  2⤵
  PID:912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LiveId/Operational"
  2⤵
  PID:260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-LocationServiceProvider/Debug"
  2⤵
  PID:2460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
  2⤵
  PID:5864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
  2⤵
  PID:4824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
  2⤵
  PID:400
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
  2⤵
  PID:1272
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:5104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
  2⤵
  PID:4260
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
  2⤵
  PID:2304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
  2⤵
  PID:2060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
  2⤵
  PID:4596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMC"
  2⤵
  PID:4100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/DMR"
  2⤵
  PID:2844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Media-Streaming/MDE"
  2⤵
  PID:772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
  2⤵
  PID:1792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
  2⤵
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
  2⤵
  - Clears Windows event logs
  PID:5924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
  2⤵
  PID:6108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
  2⤵
  - Clears Windows event logs
  PID:4184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
  2⤵
  - Clears Windows event logs
  PID:5184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
  2⤵
  PID:2724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Minstore/Analytic"
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Minstore/Debug"
  2⤵
  PID:2008
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
  2⤵
  PID:788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
  2⤵
  PID:1548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
  2⤵
  PID:2924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
  2⤵
  PID:2532
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics"
  2⤵
  - Clears Windows event logs
  PID:2560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MosHost/Operational"
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-MosHost/Performance"
  2⤵
  PID:2912
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Mprddm/Operational"
  2⤵
  PID:5724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
  2⤵
  PID:768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
  2⤵
  PID:4308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
  2⤵
  PID:1628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
  2⤵
  PID:2572
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
  2⤵
  PID:2876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
  2⤵
  PID:3860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
  2⤵
  PID:3112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ncasvc/Operational"
  2⤵
  PID:5264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
  2⤵
  PID:4072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NcdAutoSetup/Operational"
  2⤵
  - Clears Windows event logs
  PID:1616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NdisImPlatform/Operational"
  2⤵
  PID:4388
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ndu/Diagnostic"
  2⤵
  PID:5076
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
  2⤵
  PID:5992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-Connection-Broker"
  2⤵
  PID:6072
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-ExecutionContext/Operational"
  2⤵
  PID:1064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-Setup/Diagnostic"
  2⤵
  PID:6036
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
  2⤵
  PID:800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkBridge/Diagnostic"
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
  2⤵
  PID:832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
  2⤵
  PID:4208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvider/Operational"
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Analytic"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkProvisioning/Operational"
  2⤵
  PID:5932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NetworkSecurity/Debug"
  2⤵
  PID:5656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
  2⤵
  - System Time Discovery
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
  2⤵
  PID:3804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
  2⤵
  PID:3200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/Operational"
  2⤵
  PID:4660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/Performance"
  2⤵
  PID:3296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ntfs/WHC"
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLE/Clipboard-Performance"
  2⤵
  PID:6068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
  2⤵
  PID:2944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
  2⤵
  PID:3068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
  2⤵
  PID:5236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
  2⤵
  PID:1276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
  2⤵
  PID:1316
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
  2⤵
  PID:2596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
  2⤵
  PID:5612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
  2⤵
  PID:3692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
  2⤵
  PID:2948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
  2⤵
  PID:1676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
  2⤵
  PID:4280
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneBackup/Debug"
  2⤵
  PID:4696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
  2⤵
  PID:2172
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OneX/Operational"
  2⤵
  PID:5872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
  2⤵
  PID:4144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-OtpCredentialProvider/Operational"
  2⤵
  PID:4520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
  2⤵
  PID:5840
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PCI/Operational"
  2⤵
  PID:6024
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
  2⤵
  PID:2404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Analytic"
  2⤵
  PID:4160
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Debug"
  2⤵
  PID:2952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Partition/Diagnostic"
  2⤵
  PID:4648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PerceptionRuntime/Operational"
  2⤵
  PID:3520
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
  2⤵
  PID:428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Perflib/Operational"
  2⤵
  PID:5720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
  2⤵
  PID:2716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
  2⤵
  PID:3844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
  2⤵
  PID:3856
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
  2⤵
  PID:5704
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
  2⤵
  PID:5660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
  2⤵
  - Clears Windows event logs
  PID:5196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
  2⤵
  PID:2576
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
  2⤵
  PID:5672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
  2⤵
  PID:2124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
  2⤵
  - Clears Windows event logs
  PID:5000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PhotoAcq/Analytic"
  2⤵
  PID:6040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PlayToManager/Analytic"
  2⤵
  PID:4656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Policy/Analytic"
  2⤵
  PID:3108
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Policy/Operational"
  2⤵
  PID:3316
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
  2⤵
  - Clears Windows event logs
  PID:1392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
  2⤵
  PID:4956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
  2⤵
  - Power Settings
  PID:5920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
  2⤵
  PID:944
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
  2⤵
  PID:3000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
  2⤵
  PID:3332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
  2⤵
  PID:1788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
  2⤵
  PID:4268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Admin"
  2⤵
  PID:204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
  2⤵
  PID:4132
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Debug"
  2⤵
  PID:4820
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
  2⤵
  PID:5888
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintBRM/Admin"
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService-USBMon/Debug"
  2⤵
  PID:3188
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
  2⤵
  PID:4544
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
  2⤵
  PID:1504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
  2⤵
  PID:2768
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode/Operational"
  2⤵
  PID:5408
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Privacy-Auditing/Operational"
  2⤵
  PID:4424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
  2⤵
  PID:3556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
  2⤵
  PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
  2⤵
  - Clears Windows event logs
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
  2⤵
  PID:2452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
  2⤵
  PID:6064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Diagnostic"
  2⤵
  PID:1440
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Informational"
  2⤵
  PID:5256
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Proximity-Common/Performance"
  2⤵
  PID:3792
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Developer/Debug"
  2⤵
  PID:900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-InProc/Debug"
  2⤵
  PID:5404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Admin"
  2⤵
  PID:4728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Debug"
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-PushNotification-Platform/Operational"
  2⤵
  PID:1436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
  2⤵
  PID:2648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
  2⤵
  PID:6020
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
  2⤵
  PID:5504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
  2⤵
  PID:3776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RRAS/Debug"
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RRAS/Operational"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RadioManager/Analytic"
  2⤵
  PID:3236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Debug"
  2⤵
  - Clears Windows event logs
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RasAgileVpn/Operational"
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReFS/Operational"
  2⤵
  PID:1104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReFsDedupSvc/Operational"
  2⤵
  PID:616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
  2⤵
  PID:5516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
  2⤵
  PID:4716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Regsvr32/Operational"
  2⤵
  PID:2644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
  2⤵
  PID:2692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
  2⤵
  PID:6060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
  2⤵
  PID:2988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
  2⤵
  PID:1596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
  2⤵
  PID:5996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-SessionServices/Operational"
  2⤵
  PID:1824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Diagnostic"
  2⤵
  PID:4312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Remotefs-Rdbss/Operational"
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ResetEng-Trace/Diagnostic"
  2⤵
  PID:5500
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
  2⤵
  PID:4220
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
  2⤵
  PID:5300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
  2⤵
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RetailDemo/Admin"
  2⤵
  PID:4976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-RetailDemo/Operational"
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Graphics/Analytic"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Networking-BackgroundTransfer/Tracing"
  2⤵
  PID:3564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Networking/Tracing"
  2⤵
  PID:5972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Web-Http/Tracing"
  2⤵
  PID:5444
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-WebAPI/Tracing"
  2⤵
  PID:3540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTAdaptiveMediaSource"
  2⤵
  PID:4092
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTCaptureEngine"
  2⤵
  PID:1648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTMediaStreamSource"
  2⤵
  PID:5460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime-Windows-Media/WinRTTranscode"
  2⤵
  PID:3348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime/CreateInstance"
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Runtime/Error"
  2⤵
  PID:4068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SENSE/Operational"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/Analytic"
  2⤵
  PID:4780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/HelperClassDiagnostic"
  2⤵
  PID:2940
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/ObjectStateDiagnostic"
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBClient/Operational"
  2⤵
  PID:4228
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Connectivity"
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBDirect/Operational"
  2⤵
  PID:4352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Analytic"
  2⤵
  PID:5328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Audit"
  2⤵
  PID:2100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Connectivity"
  2⤵
  PID:5952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Diagnostic"
  2⤵
  PID:3568
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Operational"
  2⤵
  PID:2184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Performance"
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBServer/Security"
  2⤵
  - Clears Windows event logs
  PID:3600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Admin"
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SMBWitnessClient/Informational"
  2⤵
  PID:3552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SPB-ClassExtension/Analytic"
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SPB-HIDI2C/Analytic"
  2⤵
  - Clears Windows event logs
  PID:1552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Schannel-Events/Perf"
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdbus/Analytic"
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdbus/Debug"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sdstor/Analytic"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
  2⤵
  PID:5732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SearchUI/Diagnostic"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SearchUI/Operational"
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecureAssessment/Operational"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-EnterpriseData-FileRevocationManager/Operational"
  2⤵
  PID:3596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Operational"
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-ExchangeActiveSyncProvisioning/Performance"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-IdentityStore/Performance"
  2⤵
  PID:4680
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Isolation-BrokeringFileSystem/Operational"
  2⤵
  PID:2664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-LessPrivilegedAppContainer/Operational"
  2⤵
  PID:1236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/KernelMode"
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Mitigations/UserMode"
  2⤵
  PID:6124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Netlogon/Operational"
  2⤵
  PID:5680
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GC/Analytic"
  2⤵
  PID:688
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging/Operational"
  2⤵
  PID:1708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter"
  2⤵
  PID:3456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP-UX/Analytic"
  2⤵
  PID:6000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
  2⤵
  PID:5740
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-UserConsentVerifier/Audit"
  2⤵
  PID:3144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Security-Vault/Performance"
  2⤵
  PID:4624
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Admin"
  2⤵
  PID:1304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Operational"
  2⤵
  PID:4884
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SecurityMitigationsBroker/Perf"
  2⤵
  PID:5096
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SendTo/Diagnostic"
  2⤵
  PID:1992
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
  2⤵
  PID:4324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SenseIR/Operational"
  2⤵
  PID:4404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sensors/Debug"
  2⤵
  PID:5764
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sensors/Performance"
  2⤵
  PID:4496
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension-V2/Analytic"
  2⤵
  PID:52
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Serial-ClassExtension/Analytic"
  2⤵
  PID:3216
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
  2⤵
  PID:200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:4328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Servicing/Debug"
  2⤵
  PID:5772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
  2⤵
  PID:988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
  2⤵
  PID:5008
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupPlatform/Analytic"
  2⤵
  PID:860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
  2⤵
  PID:2996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
  2⤵
  PID:4560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AppWizCpl/Diagnostic"
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
  2⤵
  PID:5148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
  2⤵
  PID:5696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
  2⤵
  PID:5676
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredentialProviderUser/Diagnostic"
  2⤵
  PID:2828
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
  2⤵
  - Clears Windows event logs
  PID:2144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-LogonUI/Diagnostic"
  2⤵
  PID:4180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
  2⤵
  PID:2088
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-ConnectedAccountState/ActionCenter"
  2⤵
  PID:2612
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/ActionCenter"
  2⤵
  PID:1460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/AppDefaults"
  2⤵
  PID:472
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
  2⤵
  PID:4880
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/LogonTasksChannel"
  2⤵
  PID:2492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Core/Operational"
  2⤵
  PID:2756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
  2⤵
  PID:2232
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-LockScreenContent/Diagnostic"
  2⤵
  PID:5616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-OpenWith/Diagnostic"
  2⤵
  PID:1436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
  2⤵
  PID:2648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
  2⤵
  PID:6020
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Diagnostic"
  2⤵
  PID:4692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ShellCommon-StartLayoutPopulation/Operational"
  2⤵
  PID:5504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
  2⤵
  PID:3776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SleepStudy/Diagnostic"
  2⤵
  PID:3460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-Audit/Authentication"
  2⤵
  PID:3152
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-DeviceEnum/Operational"
  2⤵
  PID:3236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Admin"
  2⤵
  PID:2268
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartCard-TPM-VCard-Module/Operational"
  2⤵
  PID:2656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmartScreen/Debug"
  2⤵
  PID:1080
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Audit"
  2⤵
  PID:1104
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Connectivity"
  2⤵
  PID:616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Diagnostic"
  2⤵
  PID:4332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SmbClient/Security"
  2⤵
  PID:5516
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
  2⤵
  PID:4716
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
  2⤵
  PID:4808
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
  2⤵
  PID:2644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Spellchecking-Host/Analytic"
  2⤵
  PID:2692
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SruMon/Diagnostic"
  2⤵
  PID:4864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SrumTelemetry"
  2⤵
  PID:3428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Debug"
  2⤵
  PID:3604
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Diagnostic"
  2⤵
  PID:6060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Operational"
  2⤵
  PID:2988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StateRepository/Restricted"
  2⤵
  PID:1596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
  2⤵
  PID:5996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
  2⤵
  PID:2876
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Admin"
  2⤵
  PID:1824
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Analytic"
  2⤵
  PID:2984
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Debug"
  2⤵
  PID:872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Diagnose"
  2⤵
  PID:5500
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ATAPort/Operational"
  2⤵
  PID:5300
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Admin"
  2⤵
  - Clears Windows event logs
  PID:4772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Analytic"
  2⤵
  PID:5564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Debug"
  2⤵
  PID:4976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Diagnose"
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-ClassPnP/Operational"
  2⤵
  PID:4920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Admin"
  2⤵
  PID:1064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Analytic"
  2⤵
  - Clears Windows event logs
  PID:3564
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Debug"
  2⤵
  PID:2908
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Diagnose"
  2⤵
  PID:3540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Disk/Operational"
  2⤵
  PID:832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-NvmeDisk/Analytic"
  2⤵
  PID:1648
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-NvmeDisk/Diagnose"
  2⤵
  PID:2332
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-NvmeDisk/Operational"
  2⤵
  - Clears Windows event logs
  PID:5460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Admin"
  2⤵
  PID:5028
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Analytic"
  2⤵
  PID:4068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Debug"
  2⤵
  PID:4192
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Diagnose"
  2⤵
  PID:4348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Health"
  2⤵
  PID:4780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Storport/Operational"
  2⤵
  PID:3728
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Tiering-IoHeat/Heat"
  2⤵
  PID:3632
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storage-Tiering/Admin"
  2⤵
  PID:5428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement-PartUtil/Operational"
  2⤵
  PID:3296
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement/Debug"
  2⤵
  PID:2636
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageManagement/Operational"
  2⤵
  PID:2100
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSettings/Diagnostic"
  2⤵
  PID:3196
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Api/Operational"
  2⤵
  PID:3568
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Diagnostic"
  2⤵
  PID:2184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Operational"
  2⤵
  PID:3620
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Driver/Performance"
  2⤵
  - Clears Windows event logs
  PID:3600
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-ManagementAgent/WHC"
  2⤵
  PID:3344
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Parser/Diagnostic"
  2⤵
  PID:3552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-Parser/Operational"
  2⤵
  PID:3452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Diagnostic"
  2⤵
  PID:1552
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageSpaces-SpaceManager/Operational"
  2⤵
  PID:2504
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageVolume/Diagnostic"
  2⤵
  PID:1932
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-StorageVolume/Operational"
  2⤵
  PID:6012
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Store/Operational"
  2⤵
  PID:5956
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Storsvc/Diagnostic"
  2⤵
  PID:5368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
  2⤵
  PID:5732
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"
  2⤵
  PID:1144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sudo/Admin"
  2⤵
  PID:3376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/Main"
  2⤵
  PID:3484
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/PfApLog"
  2⤵
  PID:5436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"
  2⤵
  PID:5040
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"
  2⤵
  PID:3596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-System-Profile-HardwareId/Diagnostic"
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsHandlers/Debug"
  2⤵
  PID:5060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Debug"
  2⤵
  PID:4680
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Diagnostic"
  2⤵
  PID:2664
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-SystemSettingsThreshold/Operational"
  2⤵
  PID:1236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"
  2⤵
  PID:3936
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TCPIP/Operational"
  2⤵
  PID:6124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"
  2⤵
  PID:4176
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"
  2⤵
  PID:2900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"
  2⤵
  PID:2432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"
  2⤵
  PID:2292
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TTS/Diagnostic"
  2⤵
  PID:2124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinAPI/Diagnostic"
  2⤵
  PID:708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinUI/Diagnostic"
  2⤵
  PID:1480
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TWinUI/Operational"
  2⤵
  - Clears Windows event logs
  PID:4084
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZSync/Analytic"
  2⤵
  PID:5800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZSync/Operational"
  2⤵
  PID:3560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"
  2⤵
  PID:3180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"
  2⤵
  - Clears Windows event logs
  PID:1748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"
  2⤵
  PID:5212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Maintenance"
  2⤵
  PID:244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"
  2⤵
  PID:1124
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
  2⤵
  PID:4900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TenantRestrictions/Operational"
  2⤵
  PID:2920
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
  2⤵
  PID:4368
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
  2⤵
  PID:2928
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
  2⤵
  PID:200
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
  2⤵
  PID:4328
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
  2⤵
  PID:5772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
  2⤵
  - Clears Windows event logs
  PID:988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
  2⤵
  PID:5008
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
  2⤵
  PID:860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
  2⤵
  PID:4320
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
  2⤵
  - Clears Windows event logs
  PID:2996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
  2⤵
  PID:4560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
  2⤵
  PID:5448
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
  2⤵
  PID:5148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Admin"
  2⤵
  PID:5696
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Analytic"
  2⤵
  PID:4276
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Debug"
  2⤵
  PID:4492
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-Printers/Operational"
  2⤵
  PID:2452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
  2⤵
  PID:5652
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
  2⤵
  PID:5064
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
  2⤵
  PID:2304
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
  2⤵
  PID:5232
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
  2⤵
  PID:2056
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
  2⤵
  PID:2060
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
  2⤵
  PID:948
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
  2⤵
  PID:4508
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
  2⤵
  PID:4596
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
  2⤵
  PID:4776
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
  2⤵
  PID:4156
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
  2⤵
  PID:5616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
  2⤵
  PID:772
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Tethering-Manager/Analytic"
  2⤵
  PID:1672
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Tethering-Station/Analytic"
  2⤵
  - Clears Windows event logs
  PID:248
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"
  2⤵
  PID:1140
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"
  2⤵
  PID:1872
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Threat-Intelligence/Analytic"
  2⤵
  PID:4184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Time-Service-PTP-Provider/PTP-Operational"
  2⤵
  PID:468
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Time-Service/Operational"
  2⤵
  - Clears Windows event logs
  PID:3120
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Admin"
  2⤵
  PID:1376
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-Troubleshooting-Recommended/Operational"
  2⤵
  PID:1536
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-TunnelDriver"
  2⤵
  PID:3432
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
  2⤵
  PID:3148
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UAC/Operational"
  2⤵
  PID:2408
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"
  2⤵
  PID:2924
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"
  2⤵
  PID:2524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
  2⤵
  PID:2032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"
  2⤵
  PID:1896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"
  2⤵
  PID:2560
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-MAUSBHOST-Analytic"
  2⤵
  PID:3780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-UCMUCSICX/Operational"
  2⤵
  PID:2224
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-UCX-Analytic"
  2⤵
  PID:1184
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
  2⤵
  PID:5724
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBHUB3-Analytic"
  2⤵
  PID:4752
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
  2⤵
  PID:2428
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Analytic"
  2⤵
  PID:4308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Operational"
  2⤵
  PID:5540
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-USB-USBXHCI-Trustlet-Analytic"
  2⤵
  PID:4788
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UniversalTelemetryClient/Operational"
  2⤵
  - Clears Windows event logs
  PID:4312
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
  2⤵
  PID:3860
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel Usage/Diagnostic"
  2⤵
  PID:2420
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel/Diagnostic"
  2⤵
  PID:4220
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Control Panel/Operational"
  2⤵
  PID:3252
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Device Registration/Admin"
  2⤵
  PID:2708
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Device Registration/Debug"
  2⤵
  PID:5308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"
  2⤵
  PID:2180
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"
  2⤵
  PID:1352
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"
  2⤵
  PID:3656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-User-Loader/Operational"
  2⤵
  PID:2580
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserAccountControl/Diagnostic"
  2⤵
  PID:5972
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"
  2⤵
  PID:5452
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/ActionCenter"
  2⤵
  PID:800
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceInstall"
  2⤵
  PID:1244
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
  2⤵
  PID:4896
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"
  2⤵
  PID:3404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"
  2⤵
  PID:4748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor/Operational"
  2⤵
  PID:3372
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserSettingsBackup-EarlyDownloader/Operational"
  2⤵
  PID:4360
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UserSettingsBackup-Orchestrator/Operational"
  2⤵
  PID:5656
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UxInit/Diagnostic"
  2⤵
  PID:2000
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"
  2⤵
  PID:4628
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"
  2⤵
  PID:4288
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VHDMP-Analytic"
  2⤵
  PID:1980
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VHDMP-Operational"
  2⤵
  PID:4660
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VIRTDISK-Analytic"
  2⤵
  PID:4460
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VPN-Client/Operational"
  2⤵
  PID:1556
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VPN/Operational"
  2⤵
  PID:5424
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"
  2⤵
  PID:3032
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Admin"
  2⤵
  - Clears Windows event logs
  PID:3068
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VerifyHardwareSecurity/Operational"
  2⤵
  PID:3892
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"
  2⤵
  PID:3644
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Analytic"
  2⤵
  PID:3016
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
  2⤵
  PID:1576
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"
  2⤵
  PID:3412
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"
  2⤵
  PID:2832
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WCNWiz/Analytic"
  2⤵
  PID:5844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WDAG-PolicyEvaluator-CSP/Operational"
  2⤵
  PID:2960
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WDAG-PolicyEvaluator-GP/Operational"
  2⤵
  PID:4212
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WEPHOSTSVC/Operational"
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WER-Diag/Operational"
  2⤵
  PID:1404
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WER-PayloadHealth/Operational"
  2⤵
  PID:1348
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WFP/Analytic"
  2⤵
  - Clears Windows event logs
  PID:3616
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe cl "Microsoft-Windows-WFP/Operational"
  2⤵
  PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads