313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803

Resubmissions

10/09/2026, 08:37

260910-kh7kvszhpg10

10/09/2026, 07:31

260910-jch5msga7910

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe
Size 7.6MB
Sample260910-jch5msga79
SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
MD5 1045591681b11e496aec8bb417e6c1d3
SHA1 242ec85ff6d7fc1bf40d9edd9689b29a84386682
SHA512 f0acb708d58a60766f9487fd0cf0d746b12d1ea0b199a5122d3e986e2e6cd20c0df0f00bce909ce866171ca881abe97a7c84d1d3c81b82c1414830ba9278f96c
SSDEEP 98304:4aWmsmLcp3eOuvacXq1nVAusPnsc8EKtAmsbRAQSoEWIiPh+dK:jaVbEscWsl5p9
TLSH
T1E5866B43E2A290ECC16AC074835AA273FA32BC5D45357AAB5BD0DB313FA1F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	disable_win_def

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
1772	wevtutil.exe
3740	wevtutil.exe
4820	wevtutil.exe
1680	wevtutil.exe
1340	wevtutil.exe
5828	wevtutil.exe
3732	wevtutil.exe
4708	wevtutil.exe
1364	wevtutil.exe
2988	wevtutil.exe
3440	wevtutil.exe
2556	wevtutil.exe
1424	wevtutil.exe
968	Process not Found
7032	Process not Found
6748	Process not Found
2964	wevtutil.exe
2508	wevtutil.exe
2896	Process not Found
2940	Process not Found
7116	Process not Found
6292	Process not Found
6688	Process not Found
1772	wevtutil.exe
3972	wevtutil.exe
2092	wevtutil.exe
5820	wevtutil.exe
5596	wevtutil.exe
2572	Process not Found
6212	Process not Found
6364	Process not Found
1032	wevtutil.exe
3884	wevtutil.exe
3552	Process not Found
6776	Process not Found
4188	wevtutil.exe
4156	wevtutil.exe
1460	wevtutil.exe
3328	wevtutil.exe
4104	wevtutil.exe
5832	wevtutil.exe
6680	Process not Found
5088	wevtutil.exe
3496	wevtutil.exe
4416	wevtutil.exe
4128	wevtutil.exe
2000	wevtutil.exe
3192	wevtutil.exe
5228	Process not Found
5048	Process not Found
3516	wevtutil.exe
3680	wevtutil.exe
4416	wevtutil.exe
3060	wevtutil.exe
5968	wevtutil.exe
6132	wevtutil.exe
5608	wevtutil.exe
4396	wevtutil.exe
5372	wevtutil.exe
3028	wevtutil.exe
904	wevtutil.exe
3012	wevtutil.exe
4188	wevtutil.exe
3956	Process not Found

Detects command variations typically used by ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_GENRansomware

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_References_SecTools

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
behavioral2/memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1188	cmd.exe
5220	cmd.exe
2196	cmd.exe
2304	cmd.exe

Power Settings 1 TTPs 2 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6384	Process not Found
6352	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2412	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	Process not Found
4856	Process not Found
6376	Process not Found
2604	cmd.exe
1968	cmd.exe
708	cmd.exe
3608	cmd.exe
4980	cmd.exe
900	cmd.exe
3732	Process not Found
5112	cmd.exe
2028	cmd.exe
3440	cmd.exe
1736	cmd.exe
4372	cmd.exe
2468	Process not Found
7048	Process not Found
3024	Process not Found
6128	cmd.exe
3856	cmd.exe
6076	cmd.exe
4460	cmd.exe
4348	cmd.exe
1184	cmd.exe
4916	Process not Found
1036	Process not Found
1308	Process not Found
6736	Process not Found
6748	Process not Found
5140	cmd.exe
2052	cmd.exe
1032	cmd.exe
1852	Process not Found
3676	Process not Found
6356	Process not Found
5912	cmd.exe
4808	cmd.exe
3496	cmd.exe
5668	cmd.exe
4080	cmd.exe
1272	cmd.exe
5012	cmd.exe
2004	cmd.exe
6500	Process not Found
2200	cmd.exe
3044	cmd.exe
2792	cmd.exe
4740	cmd.exe
5104	cmd.exe
5004	cmd.exe
1700	cmd.exe
4400	Process not Found
5036	cmd.exe
4512	cmd.exe
5088	cmd.exe
3352	cmd.exe
3000	cmd.exe
5028	cmd.exe
6312	Process not Found
6744	Process not Found
5916	cmd.exe
2912	cmd.exe
6196	Process not Found
6304	Process not Found

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6612	Process not Found
6688	Process not Found

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	powershell.exe
2412	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeSecurityPrivilege	5492	wevtutil.exe
Token: SeBackupPrivilege	5492	wevtutil.exe
Token: SeSecurityPrivilege	4304	wevtutil.exe
Token: SeBackupPrivilege	4304	wevtutil.exe
Token: SeSecurityPrivilege	3396	wevtutil.exe
Token: SeBackupPrivilege	3396	wevtutil.exe
Token: SeSecurityPrivilege	4344	wevtutil.exe
Token: SeBackupPrivilege	4344	wevtutil.exe
Token: SeSecurityPrivilege	3240	wevtutil.exe
Token: SeBackupPrivilege	3240	wevtutil.exe
Token: SeSecurityPrivilege	1728	wevtutil.exe
Token: SeBackupPrivilege	1728	wevtutil.exe
Token: SeSecurityPrivilege	1364	wevtutil.exe
Token: SeBackupPrivilege	1364	wevtutil.exe
Token: SeSecurityPrivilege	3428	wevtutil.exe
Token: SeBackupPrivilege	3428	wevtutil.exe
Token: SeSecurityPrivilege	240	wevtutil.exe
Token: SeBackupPrivilege	240	wevtutil.exe
Token: SeSecurityPrivilege	4632	wevtutil.exe
Token: SeBackupPrivilege	4632	wevtutil.exe
Token: SeSecurityPrivilege	1464	wevtutil.exe
Token: SeBackupPrivilege	1464	wevtutil.exe
Token: SeSecurityPrivilege	4104	wevtutil.exe
Token: SeBackupPrivilege	4104	wevtutil.exe
Token: SeSecurityPrivilege	3508	wevtutil.exe
Token: SeBackupPrivilege	3508	wevtutil.exe
Token: SeSecurityPrivilege	1680	wevtutil.exe
Token: SeBackupPrivilege	1680	wevtutil.exe
Token: SeSecurityPrivilege	4936	wevtutil.exe
Token: SeBackupPrivilege	4936	wevtutil.exe
Token: SeSecurityPrivilege	4252	wevtutil.exe
Token: SeBackupPrivilege	4252	wevtutil.exe
Token: SeSecurityPrivilege	4128	wevtutil.exe
Token: SeBackupPrivilege	4128	wevtutil.exe
Token: SeSecurityPrivilege	4704	wevtutil.exe
Token: SeBackupPrivilege	4704	wevtutil.exe
Token: SeSecurityPrivilege	4400	wevtutil.exe
Token: SeBackupPrivilege	4400	wevtutil.exe
Token: SeSecurityPrivilege	4916	wevtutil.exe
Token: SeBackupPrivilege	4916	wevtutil.exe
Token: SeSecurityPrivilege	3308	wevtutil.exe
Token: SeBackupPrivilege	3308	wevtutil.exe
Token: SeSecurityPrivilege	2576	wevtutil.exe
Token: SeBackupPrivilege	2576	wevtutil.exe
Token: SeSecurityPrivilege	4880	wevtutil.exe
Token: SeBackupPrivilege	4880	wevtutil.exe
Token: SeSecurityPrivilege	3044	wevtutil.exe
Token: SeBackupPrivilege	3044	wevtutil.exe
Token: SeSecurityPrivilege	4412	wevtutil.exe
Token: SeBackupPrivilege	4412	wevtutil.exe
Token: SeSecurityPrivilege	4396	wevtutil.exe
Token: SeBackupPrivilege	4396	wevtutil.exe
Token: SeSecurityPrivilege	2964	wevtutil.exe
Token: SeBackupPrivilege	2964	wevtutil.exe
Token: SeSecurityPrivilege	3152	wevtutil.exe
Token: SeBackupPrivilege	3152	wevtutil.exe
Token: SeSecurityPrivilege	264	wevtutil.exe
Token: SeBackupPrivilege	264	wevtutil.exe
Token: SeSecurityPrivilege	3084	wevtutil.exe
Token: SeBackupPrivilege	3084	wevtutil.exe
Token: SeSecurityPrivilege	1772	wevtutil.exe
Token: SeBackupPrivilege	1772	wevtutil.exe
Token: SeSecurityPrivilege	3160	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1188	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	88
PID 1188 wrote to memory of 2432	1188	cmd.exe	90
PID 3448 wrote to memory of 5220	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	91
PID 5220 wrote to memory of 4916	5220	cmd.exe	93
PID 3448 wrote to memory of 2196	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	94
PID 2196 wrote to memory of 4860	2196	cmd.exe	96
PID 3448 wrote to memory of 2304	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	97
PID 2304 wrote to memory of 3500	2304	cmd.exe	99
PID 3448 wrote to memory of 3728	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	100
PID 3728 wrote to memory of 4364	3728	cmd.exe	102
PID 3448 wrote to memory of 2268	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	103
PID 2268 wrote to memory of 2436	2268	cmd.exe	105
PID 3448 wrote to memory of 2412	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	106
PID 3448 wrote to memory of 2212	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	108
PID 2212 wrote to memory of 5492	2212	cmd.exe	110
PID 3448 wrote to memory of 2568	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	111
PID 2568 wrote to memory of 4304	2568	cmd.exe	113
PID 3448 wrote to memory of 5256	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	114
PID 5256 wrote to memory of 3396	5256	cmd.exe	116
PID 3448 wrote to memory of 2184	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	117
PID 2184 wrote to memory of 4344	2184	cmd.exe	119
PID 3448 wrote to memory of 3556	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	120
PID 3556 wrote to memory of 3240	3556	cmd.exe	122
PID 3448 wrote to memory of 5128	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	123
PID 5128 wrote to memory of 1728	5128	cmd.exe	125
PID 3448 wrote to memory of 2852	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	126
PID 2852 wrote to memory of 1364	2852	cmd.exe	128
PID 3448 wrote to memory of 2764	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	129
PID 2764 wrote to memory of 3428	2764	cmd.exe	131
PID 3448 wrote to memory of 2608	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	132
PID 2608 wrote to memory of 240	2608	cmd.exe	134
PID 3448 wrote to memory of 236	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	135
PID 236 wrote to memory of 4632	236	cmd.exe	137
PID 3448 wrote to memory of 4656	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	138
PID 4656 wrote to memory of 1464	4656	cmd.exe	140
PID 3448 wrote to memory of 4872	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	141
PID 4872 wrote to memory of 4104	4872	cmd.exe	143
PID 3448 wrote to memory of 5776	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	144
PID 5776 wrote to memory of 3508	5776	cmd.exe	146
PID 3448 wrote to memory of 2860	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	147
PID 2860 wrote to memory of 1680	2860	cmd.exe	149
PID 3448 wrote to memory of 1124	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	150
PID 1124 wrote to memory of 4936	1124	cmd.exe	152
PID 3448 wrote to memory of 5112	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	153
PID 5112 wrote to memory of 4252	5112	cmd.exe	155
PID 3448 wrote to memory of 3684	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	156
PID 3684 wrote to memory of 4128	3684	cmd.exe	158
PID 3448 wrote to memory of 2376	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	159
PID 2376 wrote to memory of 4704	2376	cmd.exe	161
PID 3448 wrote to memory of 4448	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	162
PID 4448 wrote to memory of 4400	4448	cmd.exe	164
PID 3448 wrote to memory of 2456	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	165
PID 2456 wrote to memory of 4916	2456	cmd.exe	167
PID 3448 wrote to memory of 52	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	168
PID 52 wrote to memory of 3308	52	cmd.exe	170
PID 3448 wrote to memory of 1448	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	171
PID 1448 wrote to memory of 2576	1448	cmd.exe	173
PID 3448 wrote to memory of 2024	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	174
PID 2024 wrote to memory of 4880	2024	cmd.exe	176
PID 3448 wrote to memory of 2604	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	177
PID 2604 wrote to memory of 3044	2604	cmd.exe	179
PID 3448 wrote to memory of 4784	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	180
PID 4784 wrote to memory of 4412	4784	cmd.exe	182
PID 3448 wrote to memory of 5960	3448	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	183

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeUpdate\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeUpdate\" /f
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyePayload\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyePayload\" /f
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh winhttp reset proxy"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\netsh.exe
    netsh winhttp reset proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4364
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f
    3⤵
    PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Clear-History
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil el"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AMSI/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AMSI/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AirSpaceChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AirSpaceChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Application\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Application\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowFilterGraph\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowFilterGraph\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowPluginControl\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowPluginControl\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Els_Hyphenation/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Els_Hyphenation/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"EndpointMapper\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"EndpointMapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"FirstUXPerf-Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"FirstUXPerf-Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"ForwardedEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"ForwardedEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"General Logging\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"General Logging\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"HardwareEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"HardwareEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"IHM_DebugChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"IHM_DebugChannel\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-I2C/Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-I2C/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Internet Explorer\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Internet Explorer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Key Management Service\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Key Management Service\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_DshowReverseBridge\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_DshowReverseBridge\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceMFT\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceMFT\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceProxy\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationFrameServer\""
  2⤵
  PID:5960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationFrameServer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProc\""
  2⤵
  PID:3052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProc\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProcD3D\""
  2⤵
  PID:3420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProcD3D\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationAsyncWrapper\""
  2⤵
  PID:2080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationAsyncWrapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationContentProtection\""
  2⤵
  PID:2876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationContentProtection\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDS\""
  2⤵
  PID:2240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDS\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDeviceProxy\""
  2⤵
  PID:3252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMP4\""
  2⤵
  PID:716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMP4\"
    3⤵
    - Clears Windows event logs
    PID:1364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMediaEngine\""
  2⤵
  PID:2020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMediaEngine\"
    3⤵
    PID:3428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformance\""
  2⤵
  PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformance\"
    3⤵
    PID:2380
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformanceCore\""
  2⤵
  PID:752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformanceCore\"
    3⤵
    PID:1260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPipeline\""
  2⤵
  PID:3132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPipeline\"
    3⤵
    PID:808
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPlatform\""
  2⤵
  PID:1600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPlatform\"
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationSrcPrefetch\""
  2⤵
  PID:1216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationSrcPrefetch\"
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\""
  2⤵
  PID:348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\"
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Admin\""
  2⤵
  PID:4948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Admin\"
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Debug\""
  2⤵
  PID:5700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Debug\"
    3⤵
    PID:5916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Operational\""
  2⤵
  PID:3332
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Operational\"
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\""
  2⤵
  PID:4756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\"
    3⤵
    PID:5952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\""
  2⤵
  PID:3236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\"
    3⤵
    PID:4760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Admin\""
  2⤵
  PID:3020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Admin\"
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Debug\""
  2⤵
  PID:4668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Debug\"
    3⤵
    PID:1048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Diagnostic\""
  2⤵
  PID:4680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-License-Flexible-Platform/Diagnostic\"
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\""
  2⤵
  PID:1752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\"
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\""
  2⤵
  PID:5684
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\"
    3⤵
    PID:4412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\""
  2⤵
  PID:5560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IE/Diagnostic\""
  2⤵
  PID:4508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IE/Diagnostic\"
    3⤵
    PID:5752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IEFRAME/Diagnostic\""
  2⤵
  PID:3300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IEFRAME/Diagnostic\"
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\"
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-OneCore-Setup/Analytic\""
  2⤵
  PID:5984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-OneCore-Setup/Analytic\"
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\""
  2⤵
  PID:3180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\"
    3⤵
    PID:2092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\""
  2⤵
  PID:1572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\"
    3⤵
    PID:4716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-System-Diagnostics-DiagnosticInvoker/Operational\""
  2⤵
  PID:5380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-System-Diagnostics-DiagnosticInvoker/Operational\"
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\""
  2⤵
  PID:1644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\"
    3⤵
    PID:5432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\"
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\""
  2⤵
  PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\"
    3⤵
    PID:792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\""
  2⤵
  PID:3316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\"
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:6128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\"
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\""
  2⤵
  PID:1376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\"
    3⤵
    PID:3004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\""
  2⤵
  PID:5664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\"
    3⤵
    PID:712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\""
  2⤵
  PID:1668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\"
    3⤵
    PID:2944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\""
  2⤵
  PID:4692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\"
    3⤵
    PID:3284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Analytic\""
  2⤵
  PID:4840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Analytic\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Operational\""
  2⤵
  PID:3092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Operational\"
    3⤵
    PID:3216
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ADSI/Debug\""
  2⤵
  PID:6012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ADSI/Debug\"
    3⤵
    PID:3856
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ASN1/Operational\""
  2⤵
  PID:5576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ASN1/Operational\"
    3⤵
    PID:1248
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/General\""
  2⤵
  PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/General\"
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\""
  2⤵
  PID:1496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\"
    3⤵
    PID:3292
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AccelLib-AccelCx/Operational\""
  2⤵
  PID:1092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AccelLib-AccelCx/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\""
  2⤵
  PID:3088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\"
    3⤵
    PID:1340
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\""
  2⤵
  PID:5492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\"
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Admin\""
  2⤵
  PID:2660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Admin\"
    3⤵
    PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\""
  2⤵
  PID:5872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\""
  2⤵
  PID:4908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\"
    3⤵
    PID:676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Internal\""
  2⤵
  PID:4716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Internal\"
    3⤵
    PID:616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppID/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppID/Operational\"
    3⤵
    PID:2980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\""
  2⤵
  PID:6080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\"
    3⤵
    PID:4768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\""
  2⤵
  PID:3768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\"
    3⤵
    PID:4296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\""
  2⤵
  PID:3528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\"
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\""
  2⤵
  PID:2676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\"
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Verbose\""
  2⤵
  PID:5928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Verbose\"
    3⤵
    PID:4544
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\""
  2⤵
  PID:2408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\"
    3⤵
    PID:4936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\""
  2⤵
  PID:4336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\"
    3⤵
    PID:5356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\""
  2⤵
  PID:4252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\"
    3⤵
    - Clears Windows event logs
    PID:3516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\""
  2⤵
  PID:4128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\"
    3⤵
    PID:2912
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\""
  2⤵
  PID:3800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\"
    3⤵
    PID:4824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\""
  2⤵
  PID:5084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\"
    3⤵
    PID:6124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\""
  2⤵
  PID:1248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\"
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\""
  2⤵
  PID:2872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\"
    3⤵
    PID:3776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppSruProv\""
  2⤵
  PID:1348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppSruProv\"
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\""
  2⤵
  PID:3008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:1340
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\""
  2⤵
  PID:4592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\"
    3⤵
    PID:4184
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\""
  2⤵
  PID:4772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\"
    3⤵
    PID:5740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\""
  2⤵
  PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\"
    3⤵
    PID:5964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\""
  2⤵
  PID:1420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\"
    3⤵
    PID:3424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\""
  2⤵
  - Executes a command shell one-liner
  PID:708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\"
    3⤵
    PID:5124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\""
  2⤵
  PID:5136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\"
    3⤵
    PID:1756
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\""
  2⤵
  PID:4216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\"
    3⤵
    PID:5304
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\""
  2⤵
  PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\"
    3⤵
    PID:3032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\""
  2⤵
  PID:4868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\"
    3⤵
    PID:200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\""
  2⤵
  PID:2492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\"
    3⤵
    PID:1032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\""
  2⤵
  PID:2904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\""
  2⤵
  PID:3232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\"
    3⤵
    PID:4488
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\""
  2⤵
  PID:2944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\"
    3⤵
    PID:4512
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\""
  2⤵
  PID:3412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\"
    3⤵
    PID:4560
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\""
  2⤵
  PID:1636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\"
    3⤵
    PID:2888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\""
  2⤵
  PID:2472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\"
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\""
  2⤵
  - Executes a command shell one-liner
  PID:2792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\"
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\""
  2⤵
  - Executes a command shell one-liner
  PID:3856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\"
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\""
  2⤵
  - Executes a command shell one-liner
  PID:4080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\"
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\""
  2⤵
  PID:2536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\"
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\""
  2⤵
  PID:5144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2964
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\""
  2⤵
  PID:3384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\""
  2⤵
  PID:1552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\"
    3⤵
    PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\""
  2⤵
  PID:3084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\"
    3⤵
    PID:6076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\""
  2⤵
  PID:3424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\"
    3⤵
    PID:2052
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\""
  2⤵
  PID:5124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\"
    3⤵
    PID:2256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\""
  2⤵
  PID:464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\"
    3⤵
    PID:3048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\""
  2⤵
  PID:5320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\""
  2⤵
  PID:5584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\"
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Informational\""
  2⤵
  PID:1468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Informational\"
    3⤵
    - Clears Windows event logs
    PID:1032
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Operational\""
  2⤵
  PID:1884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Operational\"
    3⤵
    PID:6036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Performance\""
  2⤵
  PID:3708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Performance\"
    3⤵
    PID:5524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\""
  2⤵
  PID:5356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audit/Analytic\""
  2⤵
  PID:5116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audit/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\""
  2⤵
  PID:1860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\"
    3⤵
    PID:3516
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\""
  2⤵
  PID:4944
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\"
    3⤵
    PID:5132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\""
  2⤵
  - Executes a command shell one-liner
  PID:2912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\""
  2⤵
  PID:3964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\"
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\""
  2⤵
  PID:5660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AxInstallService/Log\""
  2⤵
  PID:3776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AxInstallService/Log\"
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\""
  2⤵
  PID:2436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\"
    3⤵
    - Clears Windows event logs
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\""
  2⤵
  - Executes a command shell one-liner
  PID:4740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\""
  2⤵
  PID:5764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\"
    3⤵
    PID:2360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\""
  2⤵
  PID:1880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\"
    3⤵
    PID:264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\""
  2⤵
  PID:1128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\"
    3⤵
    PID:3524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\"
    3⤵
    PID:1312
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\""
  2⤵
  PID:2256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\"
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Backup\""
  2⤵
  PID:1756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Backup\"
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\""
  2⤵
  PID:4296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\"
    3⤵
    PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\""
  2⤵
  PID:2056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\"
    3⤵
    PID:1076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\""
  2⤵
  PID:1464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\"
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\""
  2⤵
  PID:2916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\"
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Operational\""
  2⤵
  PID:4884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Operational\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\""
  2⤵
  PID:2648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\"
    3⤵
    PID:3376
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\""
  2⤵
  PID:5592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\"
    3⤵
    PID:712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\""
  2⤵
  PID:5612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\"
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\""
  2⤵
  PID:1460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\"
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\""
  2⤵
  PID:5488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\"
    3⤵
    PID:1048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\""
  2⤵
  PID:4736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\"
    3⤵
    PID:2388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\""
  2⤵
  PID:5896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:2988
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\""
  2⤵
  PID:1624
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\"
    3⤵
    PID:4808
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\""
  2⤵
  PID:1656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\"
    3⤵
    PID:2936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\""
  2⤵
  PID:5740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\"
    3⤵
    PID:2008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\""
  2⤵
  PID:264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\"
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\""
  2⤵
  PID:4952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\"
    3⤵
    PID:5692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCache/Operational\""
  2⤵
  PID:676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCache/Operational\"
    3⤵
    PID:4072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\""
  2⤵
  PID:2600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\""
  2⤵
  PID:3032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\"
    3⤵
    PID:3256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\""
  2⤵
  PID:6052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\"
    3⤵
    PID:1676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\""
  2⤵
  PID:5780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\"
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\""
  2⤵
  PID:3508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\"
    3⤵
    PID:2716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\""
  2⤵
  PID:2264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\"
    3⤵
    PID:948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Operational\""
  2⤵
  PID:5156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Operational\"
    3⤵
    PID:4752
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CDROM/Operational\""
  2⤵
  PID:2540
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CDROM/Operational\"
    3⤵
    PID:5036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Analytic\""
  2⤵
  PID:248
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Analytic\"
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\""
  2⤵
  PID:4848
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\"
    3⤵
    PID:436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\""
  2⤵
  PID:5840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\"
    3⤵
    PID:5648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Call\""
  2⤵
  PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Call\"
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/CreateInstance\""
  2⤵
  PID:480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/CreateInstance\"
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\""
  2⤵
  PID:1480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\"
    3⤵
    PID:4820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\""
  2⤵
  PID:5932
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\"
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\""
  2⤵
  PID:5836
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\"
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\""
  2⤵
  PID:1728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\"
    3⤵
    PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\""
  2⤵
  PID:1888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\""
  2⤵
  PID:4072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\"
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Calculator/Debug\""
  2⤵
  PID:3444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Calculator/Debug\"
    3⤵
    PID:3976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Calculator/Diagnostic\""
  2⤵
  PID:792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Calculator/Diagnostic\"
    3⤵
    PID:696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\""
  2⤵
  PID:200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\"
    3⤵
    PID:4228
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\""
  2⤵
  PID:1328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\"
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\""
  2⤵
  PID:4620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\"
    3⤵
    PID:2864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\""
  2⤵
  PID:3536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\"
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\""
  2⤵
  PID:3328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\"
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\""
  2⤵
  PID:712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\"
    3⤵
    PID:1864
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Debug\""
  2⤵
  PID:3672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Operational\""
  2⤵
  PID:4824
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudFiles-Filter/Operational\"
    3⤵
    PID:1048
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudRestoreLauncher/Operational\""
  2⤵
  PID:5424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudRestoreLauncher/Operational\"
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Debug\""
  2⤵
  PID:3500
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Debug\"
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Initialization\""
  2⤵
  PID:1768
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Initialization\"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Operational\""
  2⤵
  PID:5744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Operational\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\""
  2⤵
  PID:1120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\"
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\""
  2⤵
  PID:3152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\"
    3⤵
    PID:2044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\""
  2⤵
  PID:6044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\"
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\""
  2⤵
  PID:3464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\"
    3⤵
    PID:3736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\""
  2⤵
  PID:2040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\"
    3⤵
    PID:1676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\""
  2⤵
  PID:1984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\"
    3⤵
    PID:5276
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\""
  2⤵
  PID:4320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\"
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\""
  2⤵
  PID:2984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\"
    3⤵
    PID:4416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\""
  2⤵
  PID:5760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\"
    3⤵
    PID:3436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\""
  2⤵
  PID:4888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\"
    3⤵
    PID:1336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4156
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\""
  2⤵
  PID:4640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\"
    3⤵
    PID:244
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\""
  2⤵
  PID:1388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\"
    3⤵
    PID:2688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\""
  2⤵
  PID:1172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\"
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\""
  2⤵
  PID:820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\"
    3⤵
    PID:5728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\""
  2⤵
  PID:4608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\""
  2⤵
  PID:2524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\""
  2⤵
  PID:5416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\"
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\""
  2⤵
  PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\"
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\""
  2⤵
  PID:5964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\"
    3⤵
    PID:1364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Analytic\""
  2⤵
  PID:3976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Analytic\"
    3⤵
    PID:3240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\""
  2⤵
  PID:4228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\""
  2⤵
  PID:1680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\"
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\""
  2⤵
  PID:4488
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\"
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\""
  2⤵
  - Executes a command shell one-liner
  PID:5912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\"
    3⤵
    PID:1788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\"
    3⤵
    PID:4568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\""
  2⤵
  PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\"
    3⤵
    PID:2468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\""
  2⤵
  PID:5616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\"
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/CertInUse\""
  2⤵
  PID:1240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/CertInUse\"
    3⤵
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/KeyMgmt\""
  2⤵
  PID:3968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/KeyMgmt\"
    3⤵
    PID:4364
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\""
  2⤵
  PID:5696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\"
    3⤵
    PID:3680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\""
  2⤵
  PID:2616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\"
    3⤵
    PID:4396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\""
  2⤵
  PID:1528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\"
    3⤵
    PID:5600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\""
  2⤵
  PID:2416
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\"
    3⤵
    PID:6076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\""
  2⤵
  PID:1720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\"
    3⤵
    PID:3160
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\""
  2⤵
  PID:696
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\"
    3⤵
    PID:3852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\""
  2⤵
  PID:4104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\"
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DCLocator/Debug\""
  2⤵
  PID:6136
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DCLocator/Debug\"
    3⤵
    PID:1700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\""
  2⤵
  PID:2716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\"
    3⤵
    PID:5012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Logging\""
  2⤵
  PID:4544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Logging\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\""
  2⤵
  PID:1664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\"
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\""
  2⤵
  PID:4864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\"
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Admin\""
  2⤵
  PID:3560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Admin\"
    3⤵
    PID:4524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Analytic\""
  2⤵
  PID:2888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Analytic\"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Debug\""
  2⤵
  PID:5648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Debug\"
    3⤵
    PID:5728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Operational\""
  2⤵
  PID:1920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Operational\"
    3⤵
    PID:4392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\""
  2⤵
  PID:5160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:5372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\""
  2⤵
  PID:1780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\"
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Analytic\""
  2⤵
  PID:6064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Analytic\"
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Logging\""
  2⤵
  PID:3160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Logging\"
    3⤵
    PID:5324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXP/Analytic\""
  2⤵
  PID:2840
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXP/Analytic\"
    3⤵
    PID:4724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:4460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\"
    3⤵
    PID:904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\""
  2⤵
  PID:2128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\"
    3⤵
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\""
  2⤵
  PID:2288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\"
    3⤵
    PID:5828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\""
  2⤵
  PID:948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\"
    3⤵
    PID:3148
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\""
  2⤵
  PID:4760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\"
    3⤵
    PID:5132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\""
  2⤵
  PID:972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\"
    3⤵
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\""
  2⤵
  PID:2688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\"
    3⤵
    PID:4916
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Operational\""
  2⤵
  PID:3216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5832
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Performance\""
  2⤵
  PID:5580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Performance\"
    3⤵
    PID:1252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\""
  2⤵
  - Executes a command shell one-liner
  PID:4808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\"
    3⤵
    PID:900
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\""
  2⤵
  PID:1020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\"
    3⤵
    PID:2824
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\""
  2⤵
  PID:3396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\"
    3⤵
    PID:3524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\""
  2⤵
  PID:1364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\"
    3⤵
    PID:2092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\""
  2⤵
  PID:3408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\"
    3⤵
    PID:3972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\""
  2⤵
  PID:5620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\"
    3⤵
    PID:3612
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\""
  2⤵
  PID:1224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\"
    3⤵
    PID:888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\""
  2⤵
  PID:1324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\"
    3⤵
    - Clears Windows event logs
    PID:3732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\""
  2⤵
  PID:4900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\"
    3⤵
    PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot\""
  2⤵
  PID:4752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot\"
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\""
  2⤵
  PID:5808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\"
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\""
  2⤵
  PID:4524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\"
    3⤵
    PID:4880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\""
  2⤵
  PID:4208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\"
    3⤵
    - Clears Windows event logs
    PID:2000
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\""
  2⤵
  PID:2296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\"
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:4512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\"
    3⤵
    PID:3840
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\""
  2⤵
  PID:4076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\""
  2⤵
  PID:3924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\"
    3⤵
    PID:1296
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\""
  2⤵
  PID:5892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\"
    3⤵
    PID:5720
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\""
  2⤵
  PID:1740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\"
    3⤵
    PID:3256
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\""
  2⤵
  PID:3612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\"
    3⤵
    PID:1676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\""
  2⤵
  PID:5920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\"
    3⤵
    PID:6016
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\""
  2⤵
  PID:5712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\"
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Query/Performance\""
  2⤵
  PID:1788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Query/Performance\"
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\""
  2⤵
  PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\"
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\""
  2⤵
  PID:1048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\"
    3⤵
    PID:4880
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\""
  2⤵
  PID:4112
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\"
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\""
  2⤵
  PID:2388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\"
    3⤵
    PID:3044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\""
  2⤵
  PID:4392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\"
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\""
  2⤵
  PID:5372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\"
    3⤵
    PID:1340
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\""
  2⤵
  PID:4812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\"
    3⤵
    PID:1908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:6076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\"
    3⤵
    PID:5428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\""
  2⤵
  PID:3240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\"
    3⤵
    PID:2092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\""
  2⤵
  PID:3428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\"
    3⤵
    PID:3188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\""
  2⤵
  PID:5420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\"
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\""
  2⤵
  PID:5044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\"
    3⤵
    PID:1936
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\""
  2⤵
  PID:5908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\"
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\""
  2⤵
  PID:4568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\"
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\""
  2⤵
  PID:1108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\"
    3⤵
    PID:5524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\""
  2⤵
  PID:3860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\"
    3⤵
    PID:4892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\""
  2⤵
  PID:3336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\""
  2⤵
  PID:2988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\"
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\""
  2⤵
  PID:4572
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\"
    3⤵
    - Clears Windows event logs
    PID:4708
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\""
  2⤵
  PID:1400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\"
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\""
  2⤵
  PID:1340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\""
  2⤵
  PID:5752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\"
    3⤵
    PID:1716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\""
  2⤵
  PID:2880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\"
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\""
  2⤵
  PID:4660
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\"
    3⤵
    PID:3852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\""
  2⤵
  PID:4532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\""
  2⤵
  PID:4472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\""
  2⤵
  PID:2980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\"
    3⤵
    PID:4416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\""
  2⤵
  PID:4280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\"
    3⤵
    PID:1700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\""
  2⤵
  PID:3436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\"
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\""
  2⤵
  PID:5464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\"
    3⤵
    PID:244
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\""
  2⤵
  PID:3004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\"
    3⤵
    PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\""
  2⤵
  PID:4880
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\"
    3⤵
    PID:5260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\""
  2⤵
  PID:2228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\"
    3⤵
    PID:3308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\""
  2⤵
  PID:1148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\"
    3⤵
    PID:8
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\""
  2⤵
  PID:4708
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\"
    3⤵
    PID:4904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\""
  2⤵
  PID:1704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\"
    3⤵
    PID:4396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\""
  2⤵
  PID:4092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\"
    3⤵
    PID:5104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\""
  2⤵
  PID:616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\"
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\""
  2⤵
  PID:5428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\""
  2⤵
  - Executes a command shell one-liner
  PID:1272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\"
    3⤵
    PID:240
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\""
  2⤵
  PID:888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\"
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\""
  2⤵
  PID:3916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\"
    3⤵
    PID:1696
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectSound/Debug\""
  2⤵
  PID:4428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectSound/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Disk/Operational\""
  2⤵
  PID:6004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Disk/Operational\"
    3⤵
    PID:5596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\""
  2⤵
  PID:4644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\""
  2⤵
  PID:5260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\"
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\""
  2⤵
  PID:1472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\"
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\""
  2⤵
  PID:5756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/Analytic\"
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\""
  2⤵
  PID:2668
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/ExternalAnalytic\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\""
  2⤵
  PID:3636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Api/InternalAnalytic\"
    3⤵
    PID:1396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:5104
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dism-Cli/Analytic\"
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\""
  2⤵
  PID:4596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Debug\"
    3⤵
    PID:1948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\""
  2⤵
  PID:1076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplayColorCalibration/Operational\"
    3⤵
    PID:1504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:3608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DisplaySwitch/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:3972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Documents/Performance\""
  2⤵
  PID:2712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Documents/Performance\"
    3⤵
    PID:1184
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\""
  2⤵
  PID:5352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverFrameworks-UserMode/Operational\"
    3⤵
    PID:4744
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverProxy/Operational\""
  2⤵
  PID:5336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverProxy/Operational\"
    3⤵
    PID:4292
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DriverProxy/Performance\""
  2⤵
  PID:3012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DriverProxy/Performance\"
    3⤵
    PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\""
  2⤵
  PID:5132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-API/Diagnostic\"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Compositor/Diagnostic\""
  2⤵
  PID:2076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Compositor/Diagnostic\"
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\""
  2⤵
  PID:1652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Core/Diagnostic\"
    3⤵
    PID:3044
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\""
  2⤵
  PID:5832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Dwm/Diagnostic\"
    3⤵
    PID:5308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\""
  2⤵
  PID:5100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Redir/Diagnostic\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\""
  2⤵
  PID:3680
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dwm-Udwm/Diagnostic\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\""
  2⤵
  PID:2868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Admin\"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\""
  2⤵
  PID:2412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-Operational\"
    3⤵
    PID:1068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Debug\""
  2⤵
  PID:2336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Debug\"
    3⤵
    - Clears Windows event logs
    PID:2092
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Performance\""
  2⤵
  PID:3852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl-SysMm/Performance\"
    3⤵
    PID:1672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\""
  2⤵
  PID:3188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Contention\"
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\""
  2⤵
  PID:4148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Diagnostic\"
    3⤵
    PID:4416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\""
  2⤵
  PID:4244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Performance\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\""
  2⤵
  PID:5652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxgKrnl/Power\"
    3⤵
    PID:4352
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\""
  2⤵
  PID:4704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DxpTaskSyncProvider/Analytic\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\""
  2⤵
  PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Application-Learning/Admin\"
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\""
  2⤵
  PID:3788
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-Regular/Admin\"
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\""
  2⤵
  PID:4184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EDP-Audit-TCB/Admin\"
    3⤵
    - Clears Windows event logs
    PID:5820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Debug\""
  2⤵
  PID:4452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Debug\"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EFS/Operational\""
  2⤵
  PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EFS/Operational\"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\""
  2⤵
  PID:5628
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/IODiagnose\"
    3⤵
    PID:1596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ESE/Operational\""
  2⤵
  PID:3928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ESE/Operational\"
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Analytic\""
  2⤵
  PID:3212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Analytic\"
    3⤵
    PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Debug\""
  2⤵
  PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Debug\"
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapHost/Operational\""
  2⤵
  PID:3736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapHost/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\""
  2⤵
  PID:1972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasChap/Operational\"
    3⤵
    PID:5088
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\""
  2⤵
  PID:2972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-RasTls/Operational\"
    3⤵
    PID:5224
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\""
  2⤵
  PID:5952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Sim/Operational\"
    3⤵
    - Clears Windows event logs
    PID:5968
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EapMethods-Ttls/Operational\"
    3⤵
    PID:2432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\""
  2⤵
  PID:5056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EaseOfAccess/Diagnostic\"
    3⤵
    PID:8
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\""
  2⤵
  - Executes a command shell one-liner
  PID:3044
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/EventLog\"
    3⤵
    PID:6120
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\""
  2⤵
  PID:1312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Energy-Estimation-Engine/Trace\"
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorClass/Operational\""
  2⤵
  PID:5988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorClass/Operational\"
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\""
  2⤵
  PID:2672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic\"
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Debug\""
  2⤵
  PID:3820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Debug\"
    3⤵
    PID:5484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventCollector/Operational\""
  2⤵
  PID:4108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventCollector/Operational\"
    3⤵
    PID:904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\""
  2⤵
  PID:6016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog-WMIProvider/Debug\"
    3⤵
    PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Analytic\""
  2⤵
  PID:5272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Analytic\"
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-EventLog/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:5088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-EventLog/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Analytic\""
  2⤵
  PID:4352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Analytic\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Debug\""
  2⤵
  PID:2320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Debug\"
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FMS/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:3440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FMS/Operational\"
    3⤵
    PID:5200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\""
  2⤵
  PID:4364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Diagnostic\"
    3⤵
    PID:3264
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Operational\""
  2⤵
  PID:3512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FailoverClustering-Client/Operational\"
    3⤵
    PID:4368
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\""
  2⤵
  PID:2936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Fault-Tolerant-Heap/Operational\"
    3⤵
    - Clears Windows event logs
    PID:6132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\""
  2⤵
  PID:852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Analytic\"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\""
  2⤵
  PID:1504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FeatureConfiguration/Operational\"
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Feedback-Service-TriggerProvider\""
  2⤵
  PID:720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Feedback-Service-TriggerProvider\"
    3⤵
    PID:1424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\""
  2⤵
  PID:904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Analytic\"
    3⤵
    PID:3284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:1184
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Catalog/Debug\"
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\""
  2⤵
  PID:3148
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Analytic\"
    3⤵
    PID:2280
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\""
  2⤵
  PID:4984
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-ConfigManager/Debug\"
    3⤵
    - Clears Windows event logs
    PID:5608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\""
  2⤵
  PID:3128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Analytic\"
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\""
  2⤵
  PID:4404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/Debug\"
    3⤵
    PID:436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\""
  2⤵
  PID:1844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Core/WHC\"
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Analytic\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\""
  2⤵
  PID:1828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/BackupLog\"
    3⤵
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\""
  2⤵
  PID:5472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Engine/Debug\"
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\""
  2⤵
  PID:3048
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Analytic\"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\""
  2⤵
  PID:4912
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-EventListener/Debug\"
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\""
  2⤵
  PID:5312
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Analytic\"
    3⤵
    PID:6008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\""
  2⤵
  PID:6060
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-Service/Debug\"
    3⤵
    PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\""
  2⤵
  PID:1872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Analytic\"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\""
  2⤵
  PID:4892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileHistory-UI-Events/Debug\"
    3⤵
    - Clears Windows event logs
    PID:3192
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\""
  2⤵
  PID:2444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-FileInfoMinifilter/Operational\"
    3⤵
    PID:8
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\""
  2⤵
  PID:3804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Firewall-CPL/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:2556
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\""
  2⤵
  PID:6120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Folder Redirection/Operational\"
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Debug\""
  2⤵
  PID:3364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Debug\"
    3⤵
    PID:5028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Forwarding/Operational\""
  2⤵
  PID:5536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Forwarding/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\""
  2⤵
  PID:980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GPIO-ClassExtension/Analytic\"
    3⤵
    PID:424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\""
  2⤵
  PID:1948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GenericRoaming/Admin\"
    3⤵
    PID:6068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\""
  2⤵
  PID:1676
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-GroupPolicy/Operational\"
    3⤵
    PID:5432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HAL/Debug\""
  2⤵
  PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HAL/Debug\"
    3⤵
    PID:3868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\""
  2⤵
  PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Debug\"
    3⤵
    PID:428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\""
  2⤵
  PID:5376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenter/Performance\"
    3⤵
    PID:5308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\""
  2⤵
  PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HealthCenterCPL/Performance\"
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:4980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Debug\"
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\""
  2⤵
  PID:4368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HelloForBusiness/Operational\"
    3⤵
    PID:1396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Help/Operational\""
  2⤵
  PID:5300
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Help/Operational\"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\""
  2⤵
  PID:5040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic\"
    3⤵
    PID:3564
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\""
  2⤵
  PID:5864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HomeGroup Control Panel/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4416
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\""
  2⤵
  PID:3028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Analytic\"
    3⤵
    PID:1244
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\""
  2⤵
  PID:1336
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HotspotAuth/Operational\"
    3⤵
    PID:5460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Log\""
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Log\"
    3⤵
    PID:4424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-HttpService/Trace\""
  2⤵
  PID:4316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-HttpService/Trace\"
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\""
  2⤵
  PID:244
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Admin\"
    3⤵
    - Clears Windows event logs
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\""
  2⤵
  PID:4832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:3884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\""
  2⤵
  PID:1396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Debug\"
    3⤵
    PID:3492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\""
  2⤵
  PID:1724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose\"
    3⤵
    PID:6028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\""
  2⤵
  PID:4724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Guest-Drivers/Operational\"
    3⤵
    PID:1672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\""
  2⤵
  PID:4160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Admin\"
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\""
  2⤵
  PID:5432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Analytic\"
    3⤵
    PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\""
  2⤵
  PID:5460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-Hypervisor-Operational\"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-KMCL-Child/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-KMCL-Child/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:5596
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\""
  2⤵
  PID:2000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic\"
    3⤵
    PID:1036
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\""
  2⤵
  PID:4600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Admin\"
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\""
  2⤵
  PID:2544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Hyper-V-VID-Analytic\"
    3⤵
    - Clears Windows event logs
    PID:3740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IE-SmartScreen\""
  2⤵
  PID:3284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IE-SmartScreen\"
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKE/Operational\""
  2⤵
  PID:6008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKE/Operational\"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\""
  2⤵
  PID:5828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IKEDBG/Debug\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\""
  2⤵
  PID:1936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-Broker/Analytic\"
    3⤵
    PID:4300
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\""
  2⤵
  PID:1896
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CandidateUI/Analytic\"
    3⤵
    PID:5656
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\""
  2⤵
  PID:3304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManager/Debug\"
    3⤵
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\""
  2⤵
  PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic\"
    3⤵
    PID:2404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\""
  2⤵
  PID:4256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPAPI/Analytic\"
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\""
  2⤵
  PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPLMP/Analytic\"
    3⤵
    PID:3900
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPPRED/Analytic\"
    3⤵
    PID:4648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\""
  2⤵
  PID:3256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPSetting/Analytic\"
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\""
  2⤵
  PID:6068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-JPTIP/Analytic\"
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:2004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRAPI/Analytic\"
    3⤵
    PID:4284
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\""
  2⤵
  PID:428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-KRTIP/Analytic\"
    3⤵
    PID:436
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-OEDCompiler/Analytic\"
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\""
  2⤵
  PID:1088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCCORE/Analytic\"
    3⤵
    PID:3884
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\""
  2⤵
  PID:3064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TCTIP/Analytic\"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\""
  2⤵
  PID:1160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IME-TIP/Analytic\"
    3⤵
    PID:424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\""
  2⤵
  PID:6028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPNAT/Diagnostic\"
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\""
  2⤵
  PID:3516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPSEC-SRV/Diagnostic\"
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\""
  2⤵
  PID:5596
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Debug\"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\""
  2⤵
  PID:5728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IPxlatCfg/Operational\"
    3⤵
    PID:3676
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\""
  2⤵
  PID:3264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Analytic\"
    3⤵
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\""
  2⤵
  PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IdCtrls/Operational\"
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\""
  2⤵
  PID:5632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic\"
    3⤵
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\""
  2⤵
  PID:2232
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Input-HIDCLASS-Analytic\"
    3⤵
    PID:4632
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\""
  2⤵
  PID:3452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-InputSwitch/Diagnostic\"
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\""
  2⤵
  PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-International-RegionalOptionsControlPanel/Operational\"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:1700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Debug\"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\""
  2⤵
  PID:2556
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Operational\"
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\""
  2⤵
  PID:4412
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Iphlpsvc/Trace\"
    3⤵
    - Clears Windows event logs
    PID:1424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\""
  2⤵
  PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-KdsSvc/Operational\"
    3⤵
    PID:2572
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational\""
  2⤵
  PID:3564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational\"
    3⤵
    PID:1672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance\""
  2⤵
  PID:6036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance\"
    3⤵
    PID:2236
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kerberos/Operational\""
  2⤵
  PID:2180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kerberos/Operational\"
    3⤵
    PID:5588
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\""
  2⤵
  PID:4284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Acpi/Diagnostic\"
    3⤵
    PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\""
  2⤵
  PID:4408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/General\"
    3⤵
    PID:3568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\""
  2⤵
  PID:1252
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-AppCompat/Performance\"
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\""
  2⤵
  PID:3476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Analytic\"
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\""
  2⤵
  PID:3972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Debug\"
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\""
  2⤵
  PID:4664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-ApphelpCache/Operational\"
    3⤵
    PID:4528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\""
  2⤵
  PID:5588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Analytic\"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\""
  2⤵
  PID:5080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Boot/Operational\"
    3⤵
    PID:2404
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\""
  2⤵
  PID:3568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic\"
    3⤵
    PID:5484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-CPU-Partition/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-CPU-Partition/Analytic\"
    3⤵
    PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-CPU-Starvation/Operational\""
  2⤵
  PID:4632
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-CPU-Starvation/Operational\"
    3⤵
    PID:3732
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Cache/Operational\""
  2⤵
  PID:8
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Cache/Operational\"
    3⤵
    PID:3700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\""
  2⤵
  PID:3868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Disk/Analytic\"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Dump/Operational\""
  2⤵
  PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Dump/Operational\"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\""
  2⤵
  PID:2392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Admin\"
    3⤵
    PID:5360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\""
  2⤵
  PID:1424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-EventTracing/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:2508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\""
  2⤵
  PID:3740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-File/Analytic\"
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\""
  2⤵
  PID:4164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IO/Operational\"
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\""
  2⤵
  PID:4152
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic\"
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\""
  2⤵
  PID:2404
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-IoTrace/Diagnostic\"
    3⤵
    PID:4788
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Analytic\"
    3⤵
    PID:4768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\""
  2⤵
  PID:5368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-LiveDump/Operational\"
    3⤵
    PID:252
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\""
  2⤵
  PID:3652
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Memory/Analytic\"
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\""
  2⤵
  PID:4744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Network/Analytic\"
    3⤵
    PID:4328
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PRM/Operational\""
  2⤵
  PID:2700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PRM/Operational\"
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\""
  2⤵
  PID:5360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pdc/Diagnostic\"
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\""
  2⤵
  PID:5200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-Pep/Diagnostic\"
    3⤵
    PID:424
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Boot Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:5028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Boot Diagnostic\"
    3⤵
    PID:6020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration\""
  2⤵
  PID:5800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration\"
    3⤵
    PID:4324
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration Diagnostic\""
  2⤵
  PID:4328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Configuration Diagnostic\"
    3⤵
    PID:5308
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic\""
  2⤵
  PID:4560
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic\"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Management\""
  2⤵
  PID:2432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Device Management\"
    3⤵
    PID:1200
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Diagnostic\""
  2⤵
  PID:3376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Kernel-PnP/Driver Diagnostic\"
    3⤵
    PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

goodbye.log

Path C:\Windows\Temp\goodbye.log
Size 2KB
SHA256 17606427ffab5b24f6eeaecbc78f6d3489df43965eb3e020e72207e959a271e0
MD5 69e4816bfcd8dcabf08227c8f327a2ac
SHA1 825ab9a9584a1b25f9b326c969cb33d7598d234a
SHA512 9148d2d48bce17017e7c3168c2f0343ff5b7299457261441e10808d68ceb2bab2f439cac87c183e2c55fc8db278cde5b5b212a870931a0f0848d8aa340116f18
TLSH
T136517AB034E933A21FB29112B108EA5D535C63FBFAF58B96F2CD69006F58E15C9A04F5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-13-0x00000137D0890000-0x00000137D08B2000-memory.dmp

Download

memory/3448-17-0x00007FF7AB910000-0x00007FF7AC0B9000-memory.dmp

Download