313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803

Resubmissions

10/09/2026, 08:37

260910-kh7kvszhpg10

10/09/2026, 07:31

260910-jch5msga7910

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe
Size 7.6MB
Sample260910-jch5msga79
SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
MD5 1045591681b11e496aec8bb417e6c1d3
SHA1 242ec85ff6d7fc1bf40d9edd9689b29a84386682
SHA512 f0acb708d58a60766f9487fd0cf0d746b12d1ea0b199a5122d3e986e2e6cd20c0df0f00bce909ce866171ca881abe97a7c84d1d3c81b82c1414830ba9278f96c
SSDEEP 98304:4aWmsmLcp3eOuvacXq1nVAusPnsc8EKtAmsbRAQSoEWIiPh+dK:jaVbEscWsl5p9
TLSH
T1E5866B43E2A290ECC16AC074835AA273FA32BC5D45357AAB5BD0DB313FA1F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	disable_win_def

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5864	wevtutil.exe
5852	wevtutil.exe
5752	wevtutil.exe
5256	wevtutil.exe
6820	Process not Found
5460	Process not Found
6628	Process not Found
2232	wevtutil.exe
4592	wevtutil.exe
5328	wevtutil.exe
2780	Process not Found
6696	Process not Found
6624	Process not Found
2552	wevtutil.exe
3380	wevtutil.exe
5192	wevtutil.exe
1044	wevtutil.exe
6276	Process not Found
6264	Process not Found
6952	Process not Found
6540	Process not Found
4168	wevtutil.exe
5724	wevtutil.exe
6780	Process not Found
6848	Process not Found
4984	wevtutil.exe
536	wevtutil.exe
5752	Process not Found
2780	Process not Found
7072	Process not Found
2420	Process not Found
1600	wevtutil.exe
4764	Process not Found
3420	wevtutil.exe
4556	wevtutil.exe
4284	wevtutil.exe
4700	wevtutil.exe
2304	Process not Found
7048	Process not Found
6316	Process not Found
3400	wevtutil.exe
4668	wevtutil.exe
5764	wevtutil.exe
6004	wevtutil.exe
6532	Process not Found
6324	Process not Found
4896	Process not Found
4624	wevtutil.exe
4284	wevtutil.exe
5364	wevtutil.exe
5584	wevtutil.exe
5968	wevtutil.exe
6628	Process not Found
4992	wevtutil.exe
1892	wevtutil.exe
4788	wevtutil.exe
4788	wevtutil.exe
1216	wevtutil.exe
384	wevtutil.exe
5856	wevtutil.exe
4148	Process not Found
728	wevtutil.exe
2844	wevtutil.exe
5260	wevtutil.exe

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
behavioral1/memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2660	cmd.exe
2992	cmd.exe
3112	cmd.exe
1864	cmd.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6312	Process not Found
6240	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe
5408	cmd.exe
5004	cmd.exe
6092	cmd.exe
6508	Process not Found
3696	Process not Found
3692	cmd.exe
3324	cmd.exe
3260	cmd.exe
5508	cmd.exe
4016	cmd.exe
212	cmd.exe
5872	Process not Found
6384	Process not Found
4132	cmd.exe
2568	cmd.exe
5176	cmd.exe
4208	cmd.exe
2612	Process not Found
6896	Process not Found
6772	Process not Found
1192	cmd.exe
4272	cmd.exe
5452	cmd.exe
1664	cmd.exe
5708	cmd.exe
4488	Process not Found
4816	Process not Found
6744	Process not Found
1984	cmd.exe
5564	cmd.exe
5324	cmd.exe
5612	Process not Found
5728	Process not Found
3848	Process not Found
6200	Process not Found
6428	Process not Found
3256	cmd.exe
3328	cmd.exe
4324	cmd.exe
4192	cmd.exe
5472	cmd.exe
3196	Process not Found
6596	Process not Found
4740	cmd.exe
4596	cmd.exe
2948	cmd.exe
5644	Process not Found
5556	Process not Found
6704	Process not Found
7088	Process not Found
6188	Process not Found
1924	cmd.exe
4724	cmd.exe
5052	cmd.exe
2796	cmd.exe
6116	cmd.exe
4444	Process not Found
7020	Process not Found
7104	Process not Found
4628	cmd.exe
2088	cmd.exe
4788	cmd.exe
6136	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	Process not Found
2168	Process not Found

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2616	powershell.exe
2616	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	3468	wevtutil.exe
Token: SeBackupPrivilege	3468	wevtutil.exe
Token: SeSecurityPrivilege	4560	wevtutil.exe
Token: SeBackupPrivilege	4560	wevtutil.exe
Token: SeSecurityPrivilege	2564	wevtutil.exe
Token: SeBackupPrivilege	2564	wevtutil.exe
Token: SeSecurityPrivilege	2396	wevtutil.exe
Token: SeBackupPrivilege	2396	wevtutil.exe
Token: SeSecurityPrivilege	2092	wevtutil.exe
Token: SeBackupPrivilege	2092	wevtutil.exe
Token: SeSecurityPrivilege	2168	wevtutil.exe
Token: SeBackupPrivilege	2168	wevtutil.exe
Token: SeSecurityPrivilege	2252	wevtutil.exe
Token: SeBackupPrivilege	2252	wevtutil.exe
Token: SeSecurityPrivilege	312	wevtutil.exe
Token: SeBackupPrivilege	312	wevtutil.exe
Token: SeSecurityPrivilege	3992	wevtutil.exe
Token: SeBackupPrivilege	3992	wevtutil.exe
Token: SeSecurityPrivilege	2120	wevtutil.exe
Token: SeBackupPrivilege	2120	wevtutil.exe
Token: SeSecurityPrivilege	3324	wevtutil.exe
Token: SeBackupPrivilege	3324	wevtutil.exe
Token: SeSecurityPrivilege	4828	wevtutil.exe
Token: SeBackupPrivilege	4828	wevtutil.exe
Token: SeSecurityPrivilege	4272	wevtutil.exe
Token: SeBackupPrivilege	4272	wevtutil.exe
Token: SeSecurityPrivilege	2468	wevtutil.exe
Token: SeBackupPrivilege	2468	wevtutil.exe
Token: SeSecurityPrivilege	3328	wevtutil.exe
Token: SeBackupPrivilege	3328	wevtutil.exe
Token: SeSecurityPrivilege	4132	wevtutil.exe
Token: SeBackupPrivilege	4132	wevtutil.exe
Token: SeSecurityPrivilege	4768	wevtutil.exe
Token: SeBackupPrivilege	4768	wevtutil.exe
Token: SeSecurityPrivilege	2988	wevtutil.exe
Token: SeBackupPrivilege	2988	wevtutil.exe
Token: SeSecurityPrivilege	2208	wevtutil.exe
Token: SeBackupPrivilege	2208	wevtutil.exe
Token: SeSecurityPrivilege	4684	wevtutil.exe
Token: SeBackupPrivilege	4684	wevtutil.exe
Token: SeSecurityPrivilege	3488	wevtutil.exe
Token: SeBackupPrivilege	3488	wevtutil.exe
Token: SeSecurityPrivilege	456	wevtutil.exe
Token: SeBackupPrivilege	456	wevtutil.exe
Token: SeSecurityPrivilege	1756	wevtutil.exe
Token: SeBackupPrivilege	1756	wevtutil.exe
Token: SeSecurityPrivilege	2300	wevtutil.exe
Token: SeBackupPrivilege	2300	wevtutil.exe
Token: SeSecurityPrivilege	3456	wevtutil.exe
Token: SeBackupPrivilege	3456	wevtutil.exe
Token: SeSecurityPrivilege	4128	wevtutil.exe
Token: SeBackupPrivilege	4128	wevtutil.exe
Token: SeSecurityPrivilege	4720	wevtutil.exe
Token: SeBackupPrivilege	4720	wevtutil.exe
Token: SeSecurityPrivilege	2420	wevtutil.exe
Token: SeBackupPrivilege	2420	wevtutil.exe
Token: SeSecurityPrivilege	3372	wevtutil.exe
Token: SeBackupPrivilege	3372	wevtutil.exe
Token: SeSecurityPrivilege	1824	wevtutil.exe
Token: SeBackupPrivilege	1824	wevtutil.exe
Token: SeSecurityPrivilege	1924	wevtutil.exe
Token: SeBackupPrivilege	1924	wevtutil.exe
Token: SeSecurityPrivilege	2984	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2660	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	86
PID 2660 wrote to memory of 3840	2660	cmd.exe	88
PID 4348 wrote to memory of 2992	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	90
PID 2992 wrote to memory of 4052	2992	cmd.exe	92
PID 4348 wrote to memory of 3112	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	94
PID 3112 wrote to memory of 1236	3112	cmd.exe	96
PID 4348 wrote to memory of 1864	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	97
PID 1864 wrote to memory of 4772	1864	cmd.exe	99
PID 4348 wrote to memory of 772	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	100
PID 772 wrote to memory of 2016	772	cmd.exe	102
PID 4348 wrote to memory of 1116	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	103
PID 1116 wrote to memory of 2756	1116	cmd.exe	105
PID 4348 wrote to memory of 2616	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	106
PID 4348 wrote to memory of 112	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	108
PID 112 wrote to memory of 3468	112	cmd.exe	110
PID 4348 wrote to memory of 2860	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	111
PID 2860 wrote to memory of 4560	2860	cmd.exe	113
PID 4348 wrote to memory of 3032	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	114
PID 3032 wrote to memory of 2564	3032	cmd.exe	116
PID 4348 wrote to memory of 1136	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	117
PID 1136 wrote to memory of 2396	1136	cmd.exe	120
PID 4348 wrote to memory of 3580	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	121
PID 3580 wrote to memory of 2092	3580	cmd.exe	123
PID 4348 wrote to memory of 1580	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	124
PID 1580 wrote to memory of 2168	1580	cmd.exe	126
PID 4348 wrote to memory of 4116	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	127
PID 4116 wrote to memory of 2252	4116	cmd.exe	129
PID 4348 wrote to memory of 4740	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	130
PID 4740 wrote to memory of 312	4740	cmd.exe	132
PID 4348 wrote to memory of 1968	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	133
PID 1968 wrote to memory of 3992	1968	cmd.exe	135
PID 4348 wrote to memory of 4964	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	136
PID 4964 wrote to memory of 2120	4964	cmd.exe	138
PID 4348 wrote to memory of 2344	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	139
PID 2344 wrote to memory of 3324	2344	cmd.exe	141
PID 4348 wrote to memory of 4024	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	142
PID 4024 wrote to memory of 4828	4024	cmd.exe	144
PID 4348 wrote to memory of 1540	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	146
PID 1540 wrote to memory of 4272	1540	cmd.exe	148
PID 4348 wrote to memory of 4904	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	149
PID 4904 wrote to memory of 2468	4904	cmd.exe	151
PID 4348 wrote to memory of 1620	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	152
PID 1620 wrote to memory of 3328	1620	cmd.exe	154
PID 4348 wrote to memory of 3552	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	155
PID 3552 wrote to memory of 4132	3552	cmd.exe	158
PID 4348 wrote to memory of 2772	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	159
PID 2772 wrote to memory of 4768	2772	cmd.exe	162
PID 4348 wrote to memory of 2320	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	163
PID 2320 wrote to memory of 2988	2320	cmd.exe	166
PID 4348 wrote to memory of 636	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	167
PID 636 wrote to memory of 2208	636	cmd.exe	170
PID 4348 wrote to memory of 3216	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	171
PID 3216 wrote to memory of 4684	3216	cmd.exe	173
PID 4348 wrote to memory of 4532	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	174
PID 4532 wrote to memory of 3488	4532	cmd.exe	176
PID 4348 wrote to memory of 2964	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	177
PID 2964 wrote to memory of 456	2964	cmd.exe	179
PID 4348 wrote to memory of 2392	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	180
PID 2392 wrote to memory of 1756	2392	cmd.exe	183
PID 4348 wrote to memory of 1932	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	184
PID 1932 wrote to memory of 2300	1932	cmd.exe	186
PID 4348 wrote to memory of 4516	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	187
PID 4516 wrote to memory of 3456	4516	cmd.exe	189
PID 4348 wrote to memory of 4420	4348	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	190

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:3840
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:4052
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeUpdate\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeUpdate\" /f
    3⤵
    PID:1236
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyePayload\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyePayload\" /f
    3⤵
    PID:4772
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh winhttp reset proxy"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\system32\netsh.exe
    netsh winhttp reset proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2016
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f
    3⤵
    PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Clear-History
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil el"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AMSI/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AMSI/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AirSpaceChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AirSpaceChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Application\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Application\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowFilterGraph\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowFilterGraph\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowPluginControl\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowPluginControl\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Els_Hyphenation/Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Els_Hyphenation/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"EndpointMapper\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"EndpointMapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"FirstUXPerf-Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"FirstUXPerf-Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"ForwardedEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"ForwardedEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"General Logging\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"General Logging\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"HardwareEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"HardwareEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"IHM_DebugChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"IHM_DebugChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-I2C/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-I2C/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Internet Explorer\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Internet Explorer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Key Management Service\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Key Management Service\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceMFT\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceMFT\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceProxy\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationFrameServer\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationFrameServer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProc\""
  2⤵
  PID:4420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProc\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProcD3D\""
  2⤵
  - Executes a command shell one-liner
  PID:4724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProcD3D\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationAsyncWrapper\""
  2⤵
  PID:1176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationAsyncWrapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2420
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationContentProtection\""
  2⤵
  PID:4828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationContentProtection\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDS\""
  2⤵
  PID:2172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDS\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDeviceProxy\""
  2⤵
  PID:4044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMP4\""
  2⤵
  PID:1236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMP4\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMediaEngine\""
  2⤵
  PID:1264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMediaEngine\"
    3⤵
    PID:4492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformance\""
  2⤵
  PID:2956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformance\"
    3⤵
    - Clears Windows event logs
    PID:728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformanceCore\""
  2⤵
  PID:4336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformanceCore\"
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPipeline\""
  2⤵
  PID:2316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPipeline\"
    3⤵
    - Clears Windows event logs
    PID:4624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPlatform\""
  2⤵
  PID:2504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPlatform\"
    3⤵
    PID:2564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationSrcPrefetch\""
  2⤵
  PID:3344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationSrcPrefetch\"
    3⤵
    PID:2004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\""
  2⤵
  PID:2928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\"
    3⤵
    PID:3096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Admin\""
  2⤵
  PID:4440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Admin\"
    3⤵
    - Clears Windows event logs
    PID:2552
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Debug\""
  2⤵
  PID:1644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Debug\"
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Operational\""
  2⤵
  PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Operational\"
    3⤵
    PID:1984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\""
  2⤵
  PID:3792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\"
    3⤵
    PID:2668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\""
  2⤵
  PID:1764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\"
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\""
  2⤵
  PID:648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\"
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\""
  2⤵
  PID:5012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\"
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\""
  2⤵
  PID:3320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\"
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IE/Diagnostic\""
  2⤵
  PID:4028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IE/Diagnostic\"
    3⤵
    PID:3140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IEFRAME/Diagnostic\""
  2⤵
  PID:1960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IEFRAME/Diagnostic\"
    3⤵
    PID:3520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\""
  2⤵
  PID:1896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-OneCore-Setup/Analytic\""
  2⤵
  PID:2592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-OneCore-Setup/Analytic\"
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\""
  2⤵
  PID:4624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\"
    3⤵
    PID:3420
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\""
  2⤵
  PID:2548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\""
  2⤵
  PID:1844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\"
    3⤵
    PID:3268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\""
  2⤵
  PID:3888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\"
    3⤵
    PID:1568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\""
  2⤵
  PID:2452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\"
    3⤵
    PID:768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\""
  2⤵
  PID:1360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\"
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\""
  2⤵
  PID:1256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\"
    3⤵
    PID:1204
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\""
  2⤵
  PID:4288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2232
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\""
  2⤵
  PID:2268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\""
  2⤵
  PID:2628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\""
  2⤵
  PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\"
    3⤵
    PID:3696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\""
  2⤵
  PID:568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\"
    3⤵
    PID:2312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Analytic\""
  2⤵
  PID:3520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Analytic\"
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Operational\""
  2⤵
  PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Operational\"
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ADSI/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:3692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ADSI/Debug\"
    3⤵
    PID:2564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ASN1/Operational\""
  2⤵
  PID:2324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ASN1/Operational\"
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/General\""
  2⤵
  PID:1568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/General\"
    3⤵
    PID:3992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\""
  2⤵
  PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\"
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\""
  2⤵
  PID:2260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\"
    3⤵
    PID:3256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\""
  2⤵
  PID:5040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\"
    3⤵
    PID:2124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AllJoyn/Debug\""
  2⤵
  PID:3540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AllJoyn/Debug\"
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AllJoyn/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AllJoyn/Operational\"
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Admin\""
  2⤵
  PID:1840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Admin\"
    3⤵
    PID:3904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\""
  2⤵
  PID:4084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\"
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\""
  2⤵
  PID:2200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\"
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Internal\""
  2⤵
  PID:3236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Internal\"
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppID/Operational\""
  2⤵
  PID:1976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppID/Operational\"
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\""
  2⤵
  PID:2388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\"
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\""
  2⤵
  PID:3900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\"
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\""
  2⤵
  - Executes a command shell one-liner
  PID:3256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\"
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\""
  2⤵
  PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\"
    3⤵
    PID:1028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\""
  2⤵
  PID:1824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\"
    3⤵
    PID:3140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\""
  2⤵
  PID:4372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\"
    3⤵
    PID:3904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\""
  2⤵
  PID:2312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\"
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\""
  2⤵
  PID:3860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\"
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\""
  2⤵
  PID:3488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\"
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\""
  2⤵
  PID:1560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\"
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\""
  2⤵
  PID:2400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\"
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\""
  2⤵
  PID:768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\"
    3⤵
    PID:2668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\""
  2⤵
  PID:2120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\"
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppSruProv\""
  2⤵
  - Executes a command shell one-liner
  PID:1924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppSruProv\"
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\""
  2⤵
  PID:2468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\"
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\""
  2⤵
  PID:4544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\"
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\""
  2⤵
  PID:4872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\"
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\""
  2⤵
  PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\"
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\""
  2⤵
  PID:872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\"
    3⤵
    PID:3224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\""
  2⤵
  PID:2900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\"
    3⤵
    - Clears Windows event logs
    PID:3420
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\""
  2⤵
  PID:3244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\"
    3⤵
    PID:4040
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\""
  2⤵
  PID:1480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\"
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\""
  2⤵
  PID:1672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\"
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\""
  2⤵
  PID:1736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\"
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\""
  2⤵
  PID:4820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\"
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\""
  2⤵
  PID:4052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\""
  2⤵
  PID:4424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\"
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\""
  2⤵
  PID:3820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\"
    3⤵
    PID:560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\""
  2⤵
  PID:4528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\"
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\""
  2⤵
  PID:2988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\"
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\""
  2⤵
  PID:2108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\"
    3⤵
    - Clears Windows event logs
    PID:1600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\""
  2⤵
  PID:3992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\"
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\""
  2⤵
  PID:1948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\"
    3⤵
    - Clears Windows event logs
    PID:4592
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\""
  2⤵
  PID:2112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\"
    3⤵
    PID:540
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\""
  2⤵
  PID:2404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\"
    3⤵
    PID:632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\""
  2⤵
  PID:3184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\"
    3⤵
    PID:3756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\""
  2⤵
  PID:896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\"
    3⤵
    PID:4508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\""
  2⤵
  PID:4752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\"
    3⤵
    PID:3224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\""
  2⤵
  PID:2564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\"
    3⤵
    PID:604
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\""
  2⤵
  PID:4776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\""
  2⤵
  PID:3432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\"
    3⤵
    PID:4192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\""
  2⤵
  - Executes a command shell one-liner
  PID:3328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\"
    3⤵
    PID:2700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\""
  2⤵
  PID:1420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\"
    3⤵
    - Clears Windows event logs
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\""
  2⤵
  PID:3084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\"
    3⤵
    PID:3132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Informational\""
  2⤵
  PID:3944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Informational\"
    3⤵
    PID:1204
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Operational\""
  2⤵
  PID:3448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Operational\"
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Performance\""
  2⤵
  PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Performance\"
    3⤵
    PID:3224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\""
  2⤵
  PID:1316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\"
    3⤵
    PID:5060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audit/Analytic\""
  2⤵
  PID:1600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audit/Analytic\"
    3⤵
    PID:2668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\""
  2⤵
  PID:4184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\"
    3⤵
    PID:1500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\""
  2⤵
  PID:3768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\"
    3⤵
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\""
  2⤵
  PID:1280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\"
    3⤵
    - Clears Windows event logs
    PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\""
  2⤵
  PID:1836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\"
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\""
  2⤵
  - Executes a command shell one-liner
  PID:5052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AxInstallService/Log\""
  2⤵
  PID:1204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AxInstallService/Log\"
    3⤵
    PID:4716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\""
  2⤵
  PID:4100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\""
  2⤵
  PID:4876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\"
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\""
  2⤵
  PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\""
  2⤵
  PID:4472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\"
    3⤵
    PID:212
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\""
  2⤵
  PID:840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\"
    3⤵
    PID:5056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\""
  2⤵
  PID:4064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\"
    3⤵
    PID:3096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\""
  2⤵
  PID:4280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\"
    3⤵
    PID:1368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Backup\""
  2⤵
  PID:2288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Backup\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\""
  2⤵
  PID:2144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\"
    3⤵
    PID:5020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\""
  2⤵
  PID:3756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\"
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\""
  2⤵
  PID:3892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\""
  2⤵
  PID:1904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\"
    3⤵
    PID:4460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Operational\""
  2⤵
  PID:2668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Operational\"
    3⤵
    PID:2492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\""
  2⤵
  PID:2448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\"
    3⤵
    PID:4932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\""
  2⤵
  PID:5056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\"
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\""
  2⤵
  PID:3096
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\"
    3⤵
    PID:4756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\""
  2⤵
  PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\"
    3⤵
    PID:2596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\""
  2⤵
  PID:2972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\"
    3⤵
    PID:4320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\""
  2⤵
  PID:4316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\"
    3⤵
    PID:1928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\""
  2⤵
  PID:712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\"
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\""
  2⤵
  PID:3224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\"
    3⤵
    PID:816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\"
    3⤵
    PID:2492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\""
  2⤵
  PID:3728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\"
    3⤵
    PID:3908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\""
  2⤵
  PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\"
    3⤵
    PID:456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCache/Operational\""
  2⤵
  PID:4220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCache/Operational\"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\""
  2⤵
  PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\""
  2⤵
  PID:3868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\"
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\""
  2⤵
  PID:4000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\"
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\""
  2⤵
  PID:816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\"
    3⤵
    PID:3752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\""
  2⤵
  PID:2872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\"
    3⤵
    PID:4932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\""
  2⤵
  PID:4296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\"
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Operational\""
  2⤵
  PID:2132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Operational\"
    3⤵
    PID:456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CDROM/Operational\""
  2⤵
  PID:1368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CDROM/Operational\"
    3⤵
    PID:732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Analytic\""
  2⤵
  PID:332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Analytic\"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\""
  2⤵
  PID:5020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\"
    3⤵
    PID:4016
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\""
  2⤵
  PID:224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\"
    3⤵
    PID:4924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Call\""
  2⤵
  PID:3840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Call\"
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/CreateInstance\""
  2⤵
  - Executes a command shell one-liner
  PID:4132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/CreateInstance\"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\""
  2⤵
  PID:3456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\"
    3⤵
    PID:444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\""
  2⤵
  PID:4944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\"
    3⤵
    - Clears Windows event logs
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\""
  2⤵
  PID:3644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\"
    3⤵
    PID:4700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\""
  2⤵
  PID:1028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\"
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\""
  2⤵
  - Executes a command shell one-liner
  PID:2088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\"
    3⤵
    PID:3904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\""
  2⤵
  PID:4292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\"
    3⤵
    - Clears Windows event logs
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\""
  2⤵
  PID:4236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\""
  2⤵
  PID:928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\"
    3⤵
    PID:4932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\""
  2⤵
  PID:5028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\"
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\""
  2⤵
  PID:312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\"
    3⤵
    PID:3132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:3324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\"
    3⤵
    PID:2188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\""
  2⤵
  PID:2656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Debug\""
  2⤵
  PID:560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Debug\"
    3⤵
    PID:3420
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Operational\"
    3⤵
    PID:3980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\""
  2⤵
  PID:2492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\"
    3⤵
    PID:2124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\""
  2⤵
  PID:2396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\"
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\""
  2⤵
  PID:396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\""
  2⤵
  PID:4556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\"
    3⤵
    PID:1240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\""
  2⤵
  PID:4768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\"
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\""
  2⤵
  PID:4268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\"
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:3260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\"
    3⤵
    PID:3980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\""
  2⤵
  PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\"
    3⤵
    PID:1268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\""
  2⤵
  PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\""
  2⤵
  PID:2700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\"
    3⤵
    - Clears Windows event logs
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\""
  2⤵
  PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\"
    3⤵
    PID:2300
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Debug\""
  2⤵
  PID:2336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Debug\"
    3⤵
    PID:4320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Operational\""
  2⤵
  PID:4492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Operational\"
    3⤵
    PID:4340
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:2796
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\"
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\""
  2⤵
  PID:4956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\""
  2⤵
  PID:4008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\"
    3⤵
    PID:4032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\""
  2⤵
  PID:3912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\"
    3⤵
    PID:2672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\""
  2⤵
  PID:3584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\"
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\""
  2⤵
  PID:632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\"
    3⤵
    PID:680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\""
  2⤵
  PID:4340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\"
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\"
    3⤵
    PID:2032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\""
  2⤵
  PID:1268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Operational\""
  2⤵
  PID:540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Operational\"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\""
  2⤵
  PID:2284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\"
    3⤵
    PID:2596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\""
  2⤵
  PID:456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\""
  2⤵
  PID:4320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\"
    3⤵
    PID:1972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\""
  2⤵
  PID:1752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\"
    3⤵
    PID:4452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\""
  2⤵
  PID:2020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\"
    3⤵
    PID:4252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\""
  2⤵
  PID:4756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\""
  2⤵
  PID:1240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\"
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\""
  2⤵
  PID:2232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\"
    3⤵
    PID:4032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\""
  2⤵
  PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\"
    3⤵
    PID:2828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\""
  2⤵
  PID:4592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\"
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\""
  2⤵
  PID:920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\""
  2⤵
  PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\""
  2⤵
  PID:3908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\"
    3⤵
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\""
  2⤵
  PID:3232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAMM/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:4324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAMM/Diagnostic\"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DCLocator/Debug\""
  2⤵
  PID:1860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DCLocator/Debug\"
    3⤵
    PID:212
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\""
  2⤵
  PID:3140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:3380
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Logging\""
  2⤵
  PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Logging\"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\""
  2⤵
  PID:4172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\"
    3⤵
    PID:1972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\""
  2⤵
  PID:3980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Admin\""
  2⤵
  PID:3380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Admin\"
    3⤵
    PID:2828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Analytic\""
  2⤵
  PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Analytic\"
    3⤵
    PID:1972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Debug\""
  2⤵
  PID:3420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Debug\"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Operational\""
  2⤵
  PID:3068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Operational\"
    3⤵
    PID:2844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\""
  2⤵
  PID:2828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\"
    3⤵
    PID:1972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:1548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Analytic\""
  2⤵
  PID:876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Analytic\"
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Logging\""
  2⤵
  PID:2408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Logging\"
    3⤵
    PID:2032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXP/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXP/Analytic\"
    3⤵
    PID:2524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\""
  2⤵
  PID:4476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\"
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:4192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\"
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\""
  2⤵
  PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\"
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\""
  2⤵
  PID:2936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\""
  2⤵
  PID:2616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\"
    3⤵
    PID:536
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\""
  2⤵
  PID:3856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\"
    3⤵
    PID:4032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\""
  2⤵
  PID:3664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\"
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Operational\""
  2⤵
  PID:4032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Operational\"
    3⤵
    PID:1552
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Performance\""
  2⤵
  PID:2124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Performance\"
    3⤵
    PID:4784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\""
  2⤵
  - Executes a command shell one-liner
  PID:1984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\"
    3⤵
    PID:3732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\""
  2⤵
  PID:2552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\"
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\""
  2⤵
  PID:4568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\"
    3⤵
    PID:3632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\""
  2⤵
  PID:4728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\"
    3⤵
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic\""
  2⤵
  PID:2208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic\"
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\""
  2⤵
  PID:4952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\"
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\""
  2⤵
  PID:3636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\""
  2⤵
  PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\"
    3⤵
    PID:4668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\""
  2⤵
  PID:4968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\"
    3⤵
    PID:2008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\""
  2⤵
  PID:5108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\"
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\""
  2⤵
  PID:5132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\"
    3⤵
    PID:5192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\""
  2⤵
  PID:5212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\"
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\""
  2⤵
  PID:5280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\"
    3⤵
    PID:5324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\""
  2⤵
  PID:5344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\"
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\""
  2⤵
  PID:5476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\"
    3⤵
    PID:5520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\""
  2⤵
  PID:5536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\"
    3⤵
    PID:5584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\""
  2⤵
  PID:5600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\"
    3⤵
    PID:5644
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\""
  2⤵
  PID:5660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\"
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\""
  2⤵
  PID:5720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\"
    3⤵
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\""
  2⤵
  PID:5784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\"
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\""
  2⤵
  PID:5848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\"
    3⤵
    PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\""
  2⤵
  PID:5912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\"
    3⤵
    PID:5956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\""
  2⤵
  PID:5976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\"
    3⤵
    PID:6024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\""
  2⤵
  PID:6044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\"
    3⤵
    PID:6088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\""
  2⤵
  PID:6104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\"
    3⤵
    PID:5124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\""
  2⤵
  PID:4784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\"
    3⤵
    PID:5200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\""
  2⤵
  PID:5160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\"
    3⤵
    PID:2300
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\""
  2⤵
  PID:3904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\"
    3⤵
    PID:5032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\""
  2⤵
  PID:3316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\"
    3⤵
    PID:5276
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\""
  2⤵
  PID:5244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\"
    3⤵
    PID:5296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\""
  2⤵
  PID:5284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\"
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\""
  2⤵
  PID:5348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\"
    3⤵
    PID:5436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\"
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\""
  2⤵
  PID:5548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\"
    3⤵
    PID:5576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\""
  2⤵
  PID:5652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\"
    3⤵
    PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\""
  2⤵
  PID:5680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\"
    3⤵
    PID:5732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Perfhost/Analytic\""
  2⤵
  PID:5756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Perfhost/Analytic\"
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\""
  2⤵
  PID:5820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\"
    3⤵
    PID:5904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\""
  2⤵
  PID:5892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\"
    3⤵
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\""
  2⤵
  PID:5956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\"
    3⤵
    PID:6004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\""
  2⤵
  PID:5996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\"
    3⤵
    PID:6056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\""
  2⤵
  PID:6088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\"
    3⤵
    PID:2008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\""
  2⤵
  PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\"
    3⤵
    PID:5192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\""
  2⤵
  PID:4668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\"
    3⤵
    PID:1664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\""
  2⤵
  PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\"
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\""
  2⤵
  PID:4772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\"
    3⤵
    - Clears Windows event logs
    PID:5260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\""
  2⤵
  PID:5272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\"
    3⤵
    PID:5288
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\""
  2⤵
  PID:5292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\"
    3⤵
    PID:5404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic\""
  2⤵
  PID:5316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\"
    3⤵
    PID:5492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\""
  2⤵
  PID:5496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\"
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\""
  2⤵
  - Executes a command shell one-liner
  PID:5564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\"
    3⤵
    PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\""
  2⤵
  PID:5632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\"
    3⤵
    PID:5732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\""
  2⤵
  PID:3120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\""
  2⤵
  PID:5744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\"
    3⤵
    PID:5812
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\""
  2⤵
  PID:5788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\"
    3⤵
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\""
  2⤵
  PID:5884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\"
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\""
  2⤵
  PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\"
    3⤵
    PID:6000
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\""
  2⤵
  PID:5992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\"
    3⤵
    PID:6080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\""
  2⤵
  - Executes a command shell one-liner
  PID:6116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\"
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\""
  2⤵
  PID:6120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\"
    3⤵
    PID:536
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\""
  2⤵
  PID:4284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\"
    3⤵
    PID:5164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\""
  2⤵
  PID:5184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\"
    3⤵
    - Clears Windows event logs
    PID:4700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\""
  2⤵
  PID:5268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\""
  2⤵
  PID:5388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\"
    3⤵
    PID:5296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\""
  2⤵
  PID:5464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\"
    3⤵
    PID:5428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectSound/Debug\""
  2⤵
  PID:5520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectSound/Debug\"
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Disk/Operational\""
  2⤵
  PID:5576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Disk/Operational\"
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\""
  2⤵
  PID:5608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\"
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\""
  2⤵
  PID:3508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\"
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\""
  2⤵
  PID:4392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\"
    3⤵
    PID:5860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\""
  2⤵
  PID:5008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\"
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\""
  2⤵
  PID:5952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\"
    3⤵
    PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\""
  2⤵
  PID:6032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\"
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\""
  2⤵
  PID:5972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\"
    3⤵
    PID:6076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\""
  2⤵
  PID:2008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\"
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\""
  2⤵
  PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\"
    3⤵
    PID:1692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\""
  2⤵
  PID:2672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\"
    3⤵
    PID:5172
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Documents/Performance\""
  2⤵
  PID:5240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Documents/Performance\"
    3⤵
    PID:732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dot3MM/Diagnostic\""
  2⤵
  PID:5264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dot3MM/Diagnostic\"
    3⤵
    PID:5320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\""
  2⤵
  PID:5340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\"
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DucUpdateAgent/Operational\""
  2⤵
  PID:5380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DucUpdateAgent/Operational\"
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\"
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\""
  2⤵
  PID:5544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\"
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\""
  2⤵
  PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\""
  2⤵
  PID:5640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\"
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\""
  2⤵
  PID:5860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:5864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\""
  2⤵
  PID:3296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\"
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\""
  2⤵
  PID:1928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\"
    3⤵
    PID:6024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\""
  2⤵
  PID:5988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\"
    3⤵
    PID:6060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\""
  2⤵
  PID:5928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\"
    3⤵
    PID:384
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\""
  2⤵
  PID:6132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\"
    3⤵
    PID:6136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\""
  2⤵
  PID:3424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\""
  2⤵
  PID:4980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\""
  2⤵
  PID:5320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\"
    3⤵
    PID:5404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\""
  2⤵
  PID:5400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\"
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\""
  2⤵
  PID:5504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\"
    3⤵
    PID:5480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Debug\""
  2⤵
  PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Debug\"
    3⤵
    PID:5668
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\""
  2⤵
  PID:5568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\"
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/Operational\""
  2⤵
  PID:2228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/Operational\"
    3⤵
    PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Analytic\""
  2⤵
  PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Analytic\"
    3⤵
    PID:5824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Debug\""
  2⤵
  PID:5876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Debug\"
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Operational\""
  2⤵
  PID:6028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Operational\"
    3⤵
    PID:5728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\""
  2⤵
  PID:6008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\""
  2⤵
  PID:6052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\""
  2⤵
  PID:5196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\"
    3⤵
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\""
  2⤵
  PID:1008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\"
    3⤵
    PID:2596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\""
  2⤵
  PID:5224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\"
    3⤵
    PID:4932
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\""
  2⤵
  PID:4452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\"
    3⤵
    PID:5484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\""
  2⤵
  PID:420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\"
    3⤵
    PID:5392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\""
  2⤵
  PID:5372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\"
    3⤵
    PID:5420
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Debug\""
  2⤵
  PID:5444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Debug\"
    3⤵
    - Clears Windows event logs
    PID:5584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Operational\""
  2⤵
  PID:5424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Operational\"
    3⤵
    PID:5708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\""
  2⤵
  PID:5624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\"
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Analytic\""
  2⤵
  PID:5768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Analytic\"
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Debug\""
  2⤵
  PID:5604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Debug\"
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Analytic\""
  2⤵
  PID:5944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Analytic\"
    3⤵
    PID:5924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Debug\""
  2⤵
  PID:6056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Debug\"
    3⤵
    PID:6092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Operational\""
  2⤵
  PID:6040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Operational\"
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\""
  2⤵
  PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\"
    3⤵
    PID:444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\"
    3⤵
    PID:5328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\""
  2⤵
  PID:5236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\"
    3⤵
    PID:5656
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\""
  2⤵
  PID:5392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\"
    3⤵
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\""
  2⤵
  PID:5448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\"
    3⤵
    PID:5456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\""
  2⤵
  PID:5712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\"
    3⤵
    PID:2876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\""
  2⤵
  PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\"
    3⤵
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\""
  2⤵
  PID:5596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\"
    3⤵
    PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\""
  2⤵
  PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\"
    3⤵
    PID:5960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\""
  2⤵
  PID:1792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\"
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\""
  2⤵
  PID:5204
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\"
    3⤵
    PID:6012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\"
    3⤵
    PID:6048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\""
  2⤵
  PID:5172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\"
    3⤵
    PID:5468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\""
  2⤵
  PID:2300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\"
    3⤵
    PID:5352
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\""
  2⤵
  PID:5416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\"
    3⤵
    PID:5300
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\""
  2⤵
  PID:5428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\"
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\""
  2⤵
  PID:5356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\"
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\"
    3⤵
    - Clears Windows event logs
    PID:5752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\""
  2⤵
  PID:5684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\"
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\""
  2⤵
  PID:5900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\"
    3⤵
    PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\""
  2⤵
  PID:6096
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\"
    3⤵
    PID:5940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\""
  2⤵
  PID:6060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\"
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\""
  2⤵
  PID:6080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\"
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Debug\""
  2⤵
  PID:1876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Debug\"
    3⤵
    PID:5200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:5324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Operational\"
    3⤵
    PID:5220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\""
  2⤵
  PID:5148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\"
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\""
  2⤵
  PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\"
    3⤵
    PID:5532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\""
  2⤵
  PID:3452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\"
    3⤵
    PID:5760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HAL/Debug\""
  2⤵
  PID:5512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HAL/Debug\"
    3⤵
    PID:5612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\""
  2⤵
  PID:5816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\"
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\""
  2⤵
  PID:5792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\"
    3⤵
    PID:5980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\""
  2⤵
  PID:5888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\"
    3⤵
    PID:5920
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\""
  2⤵
  PID:6020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\"
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Help/Operational\""
  2⤵
  PID:6072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Help/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\""
  2⤵
  PID:5200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\"
    3⤵
    PID:5352
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\""
  2⤵
  PID:4200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\"
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Listener Service/Operational\""
  2⤵
  PID:5404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Listener Service/Operational\"
    3⤵
    PID:5532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic\"
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Provider Service/Operational\""
  2⤵
  PID:5248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Provider Service/Operational\"
    3⤵
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup-ListenerService\""
  2⤵
  PID:5716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup-ListenerService\"
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\""
  2⤵
  PID:4160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:536
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\""
  2⤵
  PID:5688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\"
    3⤵
    PID:6076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Log\""
  2⤵
  PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Log\"
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Trace\""
  2⤵
  PID:6108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Trace\"
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\""
  2⤵
  PID:4932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\"
    3⤵
    PID:1216
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\""
  2⤵
  PID:5440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\"
    3⤵
    PID:880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\""
  2⤵
  PID:5308
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\"
    3⤵
    PID:5312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\""
  2⤵
  PID:5500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\"
    3⤵
    PID:2084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\""
  2⤵
  PID:5760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\"
    3⤵
    PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\""
  2⤵
  PID:4652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\"
    3⤵
    PID:5748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\""
  2⤵
  PID:2908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\"
    3⤵
    PID:5620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\""
  2⤵
  PID:5868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\"
    3⤵
    - Clears Windows event logs
    PID:6004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\""
  2⤵
  PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\"
    3⤵
    PID:5852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\""
  2⤵
  PID:5024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\"
    3⤵
    PID:5256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:6092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IE-SmartScreen\""
  2⤵
  PID:4216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IE-SmartScreen\"
    3⤵
    PID:5412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKE/Operational\""
  2⤵
  PID:732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKE/Operational\"
    3⤵
    PID:5368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\"
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\""
  2⤵
  PID:2876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\"
    3⤵
    PID:1412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\""
  2⤵
  PID:5524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\"
    3⤵
    PID:5748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\""
  2⤵
  PID:5832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\"
    3⤵
    - Clears Windows event logs
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\""
  2⤵
  PID:5904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\"
    3⤵
    PID:6004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\""
  2⤵
  PID:5824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\"
    3⤵
    PID:2816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\""
  2⤵
  PID:6076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\"
    3⤵
    PID:5936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\""
  2⤵
  PID:5932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:1216
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\""
  2⤵
  PID:1472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\"
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:6136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\"
    3⤵
    PID:5156
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\""
  2⤵
  PID:4368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\"
    3⤵
    PID:5528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\""
  2⤵
  PID:1724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\"
    3⤵
    PID:5532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:2568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\"
    3⤵
    PID:5772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\""
  2⤵
  PID:5840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\"
    3⤵
    PID:5764
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\""
  2⤵
  PID:5812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\"
    3⤵
    PID:5724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\""
  2⤵
  PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\"
    3⤵
    PID:6036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\""
  2⤵
  PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\"
    3⤵
    PID:5484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\""
  2⤵
  PID:5140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\"
    3⤵
    PID:880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\""
  2⤵
  PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\"
    3⤵
    PID:3928
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\""
  2⤵
  PID:444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\"
    3⤵
    - Clears Windows event logs
    PID:384
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\""
  2⤵
  PID:5552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\"
    3⤵
    PID:5480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\""
  2⤵
  PID:1692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\"
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\""
  2⤵
  PID:4948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\"
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\""
  2⤵
  PID:4924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\"
    3⤵
    - Clears Windows event logs
    PID:1044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\""
  2⤵
  PID:5940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\"
    3⤵
    PID:5864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\""
  2⤵
  PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\"
    3⤵
    PID:5208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\""
  2⤵
  PID:1372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\"
    3⤵
    PID:5152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\""
  2⤵
  PID:6112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\"
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\""
  2⤵
  PID:384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\"
    3⤵
    PID:5560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\""
  2⤵
  PID:5300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\"
    3⤵
    PID:1412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos/Operational\""
  2⤵
  PID:5748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos/Operational\"
    3⤵
    PID:2516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\""
  2⤵
  PID:5984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\"
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\""
  2⤵
  PID:1044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\""
  2⤵
  PID:4720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\"
    3⤵
    - Clears Windows event logs
    PID:5256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\""
  2⤵
  PID:5908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\""
  2⤵
  PID:6048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:5176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\"
    3⤵
    PID:5732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\""
  2⤵
  PID:5368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\"
    3⤵
    PID:1412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\""
  2⤵
  PID:5492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\"
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\""
  2⤵
  PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\"
    3⤵
    PID:2304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\""
  2⤵
  PID:536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\"
    3⤵
    PID:1784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\""
  2⤵
  PID:5980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\"
    3⤵
    PID:5924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\""
  2⤵
  PID:5468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\"
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\""
  2⤵
  PID:4700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\"
    3⤵
    PID:5412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\""
  2⤵
  PID:6000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\"
    3⤵
    PID:5312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\""
  2⤵
  PID:5532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\"
    3⤵
    PID:1488
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\""
  2⤵
  PID:5232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\"
    3⤵
    PID:5592
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\""
  2⤵
  PID:4404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\"
    3⤵
    PID:5724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\""
  2⤵
  PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\"
    3⤵
    PID:3608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\""
  2⤵
  PID:5484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\"
    3⤵
    PID:5616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\""
  2⤵
  PID:176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\"
    3⤵
    PID:1832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\""
  2⤵
  PID:5732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\"
    3⤵
    PID:1732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\""
  2⤵
  PID:5364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\"
    3⤵
    PID:5776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Boot Diagnostic\""
  2⤵
  PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Boot Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:5856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration\""
  2⤵
  PID:5220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration\"
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration Diagnostic\""
  2⤵
  PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration Diagnostic\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic\""
  2⤵
  PID:1832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic\"
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Diagnostic\""
  2⤵
  PID:1732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Diagnostic\"
    3⤵
    PID:4816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Watchdog\""
  2⤵
  PID:5736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Watchdog\"
    3⤵
    PID:5856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Power/Diagnostic\""
  2⤵
  PID:5936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Power/Diagnostic\"
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Power/Thermal-Diagnostic\""
  2⤵
  PID:5880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Power/Thermal-Diagnostic\"
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Power/Thermal-Operational\""
  2⤵
  PID:5852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Power/Thermal-Operational\"
    3⤵
    PID:5412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Prefetch/Diagnostic\""
  2⤵
  PID:5128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Prefetch/Diagnostic\"
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Process/Analytic\""
  2⤵
  PID:1552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Process/Analytic\"
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Processor-Power/Diagnostic\""
  2⤵
  PID:3876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Processor-Power/Diagnostic\"
    3⤵
    PID:5872
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Registry/Analytic\""
  2⤵
  PID:5724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Registry/Analytic\"
    3⤵
    PID:4856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Registry/Performance\""
  2⤵
  PID:6004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Registry/Performance\"
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ShimEngine/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:4208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ShimEngine/Debug\"
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ShimEngine/Diagnostic\""
  2⤵
  PID:5032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ShimEngine/Diagnostic\"
    3⤵
    PID:1660
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ShimEngine/Operational\""
  2⤵
  PID:5304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ShimEngine/Operational\"
    3⤵
    PID:3824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-StoreMgr/Analytic\""
  2⤵
  PID:1064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-StoreMgr/Analytic\"
    3⤵
    PID:5256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-StoreMgr/Operational\""
  2⤵
  PID:5528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-StoreMgr/Operational\"
    3⤵
    PID:1132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-WDI/Analytic\""
  2⤵
  PID:5696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-WDI/Analytic\"
    3⤵
    PID:3884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-WDI/Debug\""
  2⤵
  PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-WDI/Debug\"
    3⤵
    PID:2256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-WDI/Operational\""
  2⤵
  PID:1660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-WDI/Operational\"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-WHEA/Errors\""
  2⤵
  PID:5208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-WHEA/Errors\"
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-WHEA/Operational\""
  2⤵
  PID:1412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-WHEA/Operational\"
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-XDV/Analytic\""
  2⤵
  PID:3608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-XDV/Analytic\"
    3⤵
    PID:5620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KeyboardFilter/Admin\""
  2⤵
  PID:3704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KeyboardFilter/Admin\"
    3⤵
    PID:3864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KeyboardFilter/Operational\""
  2⤵
  PID:5420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KeyboardFilter/Operational\"
    3⤵
    PID:4600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KeyboardFilter/Performance\""
  2⤵
  PID:1336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KeyboardFilter/Performance\"
    3⤵
    PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_pv2gmz45.dqm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pv2gmz45.dqm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

goodbye.log

Path C:\Windows\Temp\goodbye.log
Size 2KB
SHA256 5f0ef3b19f392fea4411e5e02287f0b77c1559020aee0e88ddfdc480f54ce628
MD5 762e90467f728f3bf3ac58558aa604e6
SHA1 e0acbd739edeb5ec3fce01e148d7efc2adf136ec
SHA512 8b9ea91fa77cbc3dd14846a867e1c226740821e9e9cf08fa73467cf3da2c2958111b5c19dcb181e777653eabe4d4bd257ef50a107fa73dc79a5babbf8a316bb9
TLSH
T1FB519BB034E833A21FB29012B148DA0C435C63FBFAF58B96F2CD29046F58E14C9A08F0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2616-18-0x00000286CBF30000-0x00000286CBF52000-memory.dmp

Download

memory/4348-23-0x00007FF6B7F70000-0x00007FF6B8719000-memory.dmp

Download