313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803

Resubmissions

10/09/2026, 08:37

260910-kh7kvszhpg10

10/09/2026, 07:31

260910-jch5msga7910

Analysis

user interaction
yes
max time kernel
71s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe
Size 7.6MB
Sample260910-kh7kvszhpg
SHA256 313bc0bf86f2cc1e2be21344c1d19f0c2dd069f7e4dc51f2cfbfe2dc25c36803
MD5 1045591681b11e496aec8bb417e6c1d3
SHA1 242ec85ff6d7fc1bf40d9edd9689b29a84386682
SHA512 f0acb708d58a60766f9487fd0cf0d746b12d1ea0b199a5122d3e986e2e6cd20c0df0f00bce909ce866171ca881abe97a7c84d1d3c81b82c1414830ba9278f96c
SSDEEP 98304:4aWmsmLcp3eOuvacXq1nVAusPnsc8EKtAmsbRAQSoEWIiPh+dK:jaVbEscWsl5p9
TLSH
T1E5866B43E2A290ECC16AC074835AA273FA32BC5D45357AAB5BD0DB313FA1F506B1DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/4216-23-0x00007FF6062A0000-0x00007FF606A49000-memory.dmp	disable_win_def

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
688	wevtutil.exe
3504	wevtutil.exe
4712	wevtutil.exe
360	wevtutil.exe
2584	wevtutil.exe
3316	wevtutil.exe
2820	wevtutil.exe
2440	wevtutil.exe
4860	wevtutil.exe
3440	wevtutil.exe
3320	wevtutil.exe
4372	wevtutil.exe
4180	wevtutil.exe
4132	wevtutil.exe
1852	wevtutil.exe
3520	wevtutil.exe
2104	wevtutil.exe
4084	wevtutil.exe
1828	wevtutil.exe
1680	wevtutil.exe
2508	wevtutil.exe
3768	wevtutil.exe
1096	wevtutil.exe
4956	wevtutil.exe
4024	wevtutil.exe
1804	wevtutil.exe
2892	wevtutil.exe
2648	wevtutil.exe
2172	wevtutil.exe
1652	wevtutil.exe
2520	wevtutil.exe
740	wevtutil.exe
360	wevtutil.exe
2816	wevtutil.exe
3460	wevtutil.exe
1016	wevtutil.exe
4728	wevtutil.exe
2448	wevtutil.exe
2496	wevtutil.exe
3144	wevtutil.exe
552	wevtutil.exe
2976	wevtutil.exe
2892	wevtutil.exe
3924	wevtutil.exe
1704	wevtutil.exe
3320	wevtutil.exe
3716	wevtutil.exe
4688	wevtutil.exe
2012	wevtutil.exe
2420	wevtutil.exe
4172	wevtutil.exe
4776	wevtutil.exe
1852	wevtutil.exe
4372	wevtutil.exe
3876	wevtutil.exe
4180	wevtutil.exe
992	wevtutil.exe
4492	wevtutil.exe
2976	wevtutil.exe
1892	wevtutil.exe
4904	wevtutil.exe
1692	wevtutil.exe
1692	wevtutil.exe
3528	wevtutil.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4504	cmd.exe
4996	cmd.exe
968	cmd.exe
1672	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3500	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5016	cmd.exe
4988	cmd.exe
2376	cmd.exe
876	cmd.exe
1580	cmd.exe
4756	cmd.exe
496	cmd.exe
3036	cmd.exe
1992	cmd.exe
3704	cmd.exe
2736	cmd.exe
4324	cmd.exe
1860	cmd.exe
4688	cmd.exe
4364	cmd.exe
1016	cmd.exe
4444	cmd.exe
4168	cmd.exe
3496	cmd.exe
3964	cmd.exe
4124	cmd.exe
892	cmd.exe
5076	cmd.exe
2956	cmd.exe
2636	cmd.exe
5068	cmd.exe
1752	cmd.exe
1856	cmd.exe
3528	cmd.exe
4468	cmd.exe
4672	cmd.exe
3288	cmd.exe
4852	cmd.exe
1868	cmd.exe
1092	cmd.exe
4760	cmd.exe
3440	cmd.exe
2352	cmd.exe
4600	cmd.exe
3820	cmd.exe
4520	cmd.exe
3116	cmd.exe
1876	cmd.exe
860	cmd.exe
3024	cmd.exe
3884	cmd.exe
2648	cmd.exe
4776	cmd.exe
2380	cmd.exe
216	cmd.exe
3948	cmd.exe
4268	cmd.exe
4764	cmd.exe
1592	cmd.exe
1900	cmd.exe
220	cmd.exe
2384	cmd.exe
3368	cmd.exe
3264	cmd.exe
4088	cmd.exe
5004	cmd.exe
4928	cmd.exe
4108	cmd.exe
4280	cmd.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\SystemBiosInformation"	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\VideoBiosVersion"	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3500	powershell.exe
3500	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeSecurityPrivilege	4164	wevtutil.exe
Token: SeBackupPrivilege	4164	wevtutil.exe
Token: SeSecurityPrivilege	5068	wevtutil.exe
Token: SeBackupPrivilege	5068	wevtutil.exe
Token: SeSecurityPrivilege	4972	wevtutil.exe
Token: SeBackupPrivilege	4972	wevtutil.exe
Token: SeSecurityPrivilege	1804	wevtutil.exe
Token: SeBackupPrivilege	1804	wevtutil.exe
Token: SeSecurityPrivilege	524	wevtutil.exe
Token: SeBackupPrivilege	524	wevtutil.exe
Token: SeSecurityPrivilege	4180	wevtutil.exe
Token: SeBackupPrivilege	4180	wevtutil.exe
Token: SeSecurityPrivilege	4276	wevtutil.exe
Token: SeBackupPrivilege	4276	wevtutil.exe
Token: SeSecurityPrivilege	2320	wevtutil.exe
Token: SeBackupPrivilege	2320	wevtutil.exe
Token: SeSecurityPrivilege	4908	wevtutil.exe
Token: SeBackupPrivilege	4908	wevtutil.exe
Token: SeSecurityPrivilege	1996	wevtutil.exe
Token: SeBackupPrivilege	1996	wevtutil.exe
Token: SeSecurityPrivilege	992	wevtutil.exe
Token: SeBackupPrivilege	992	wevtutil.exe
Token: SeSecurityPrivilege	4188	wevtutil.exe
Token: SeBackupPrivilege	4188	wevtutil.exe
Token: SeSecurityPrivilege	1700	wevtutil.exe
Token: SeBackupPrivilege	1700	wevtutil.exe
Token: SeSecurityPrivilege	228	wevtutil.exe
Token: SeBackupPrivilege	228	wevtutil.exe
Token: SeSecurityPrivilege	1704	wevtutil.exe
Token: SeBackupPrivilege	1704	wevtutil.exe
Token: SeSecurityPrivilege	4084	wevtutil.exe
Token: SeBackupPrivilege	4084	wevtutil.exe
Token: SeSecurityPrivilege	3320	wevtutil.exe
Token: SeBackupPrivilege	3320	wevtutil.exe
Token: SeSecurityPrivilege	3024	wevtutil.exe
Token: SeBackupPrivilege	3024	wevtutil.exe
Token: SeSecurityPrivilege	656	wevtutil.exe
Token: SeBackupPrivilege	656	wevtutil.exe
Token: SeSecurityPrivilege	2028	wevtutil.exe
Token: SeBackupPrivilege	2028	wevtutil.exe
Token: SeSecurityPrivilege	4956	wevtutil.exe
Token: SeBackupPrivilege	4956	wevtutil.exe
Token: SeSecurityPrivilege	4792	wevtutil.exe
Token: SeBackupPrivilege	4792	wevtutil.exe
Token: SeSecurityPrivilege	2448	wevtutil.exe
Token: SeBackupPrivilege	2448	wevtutil.exe
Token: SeSecurityPrivilege	360	wevtutil.exe
Token: SeBackupPrivilege	360	wevtutil.exe
Token: SeSecurityPrivilege	1792	wevtutil.exe
Token: SeBackupPrivilege	1792	wevtutil.exe
Token: SeSecurityPrivilege	2636	wevtutil.exe
Token: SeBackupPrivilege	2636	wevtutil.exe
Token: SeSecurityPrivilege	4748	wevtutil.exe
Token: SeBackupPrivilege	4748	wevtutil.exe
Token: SeSecurityPrivilege	3020	wevtutil.exe
Token: SeBackupPrivilege	3020	wevtutil.exe
Token: SeSecurityPrivilege	3808	wevtutil.exe
Token: SeBackupPrivilege	3808	wevtutil.exe
Token: SeSecurityPrivilege	3144	wevtutil.exe
Token: SeBackupPrivilege	3144	wevtutil.exe
Token: SeSecurityPrivilege	1716	wevtutil.exe
Token: SeBackupPrivilege	1716	wevtutil.exe
Token: SeSecurityPrivilege	2996	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1092	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	86
PID 1092 wrote to memory of 2608	1092	cmd.exe	88
PID 4216 wrote to memory of 5040	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	89
PID 5040 wrote to memory of 1792	5040	cmd.exe	91
PID 4216 wrote to memory of 4992	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	92
PID 4992 wrote to memory of 1888	4992	cmd.exe	94
PID 4216 wrote to memory of 3804	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	95
PID 3804 wrote to memory of 4388	3804	cmd.exe	97
PID 4216 wrote to memory of 1256	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	98
PID 1256 wrote to memory of 3656	1256	cmd.exe	100
PID 4216 wrote to memory of 1672	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	105
PID 1672 wrote to memory of 2996	1672	cmd.exe	107
PID 4216 wrote to memory of 4504	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	108
PID 4504 wrote to memory of 4728	4504	cmd.exe	110
PID 4216 wrote to memory of 4996	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	111
PID 4996 wrote to memory of 224	4996	cmd.exe	113
PID 4216 wrote to memory of 968	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	114
PID 968 wrote to memory of 960	968	cmd.exe	116
PID 4216 wrote to memory of 1228	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	117
PID 1228 wrote to memory of 3320	1228	cmd.exe	120
PID 4216 wrote to memory of 3264	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	121
PID 3264 wrote to memory of 3440	3264	cmd.exe	123
PID 4216 wrote to memory of 3500	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	124
PID 4216 wrote to memory of 4896	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	126
PID 4896 wrote to memory of 4164	4896	cmd.exe	128
PID 4216 wrote to memory of 1240	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	129
PID 1240 wrote to memory of 5068	1240	cmd.exe	131
PID 4216 wrote to memory of 3328	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	132
PID 3328 wrote to memory of 4972	3328	cmd.exe	134
PID 4216 wrote to memory of 4088	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	135
PID 4088 wrote to memory of 1804	4088	cmd.exe	137
PID 4216 wrote to memory of 2784	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	138
PID 2784 wrote to memory of 524	2784	cmd.exe	140
PID 4216 wrote to memory of 4256	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	141
PID 4256 wrote to memory of 4180	4256	cmd.exe	143
PID 4216 wrote to memory of 4340	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	144
PID 4340 wrote to memory of 4276	4340	cmd.exe	147
PID 4216 wrote to memory of 4520	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	148
PID 4520 wrote to memory of 2320	4520	cmd.exe	150
PID 4216 wrote to memory of 1888	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	151
PID 1888 wrote to memory of 4908	1888	cmd.exe	153
PID 4216 wrote to memory of 2376	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	154
PID 2376 wrote to memory of 1996	2376	cmd.exe	156
PID 4216 wrote to memory of 1812	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	157
PID 1812 wrote to memory of 992	1812	cmd.exe	159
PID 4216 wrote to memory of 1444	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	160
PID 1444 wrote to memory of 4188	1444	cmd.exe	162
PID 4216 wrote to memory of 1132	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	163
PID 1132 wrote to memory of 1700	1132	cmd.exe	165
PID 4216 wrote to memory of 3424	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	166
PID 3424 wrote to memory of 228	3424	cmd.exe	168
PID 4216 wrote to memory of 2372	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	169
PID 2372 wrote to memory of 1704	2372	cmd.exe	171
PID 4216 wrote to memory of 3116	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	172
PID 3116 wrote to memory of 4084	3116	cmd.exe	174
PID 4216 wrote to memory of 4304	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	175
PID 4304 wrote to memory of 3320	4304	cmd.exe	177
PID 4216 wrote to memory of 3448	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	178
PID 3448 wrote to memory of 3024	3448	cmd.exe	180
PID 4216 wrote to memory of 1592	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	181
PID 1592 wrote to memory of 656	1592	cmd.exe	183
PID 4216 wrote to memory of 2832	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	185
PID 2832 wrote to memory of 2028	2832	cmd.exe	188
PID 4216 wrote to memory of 1928	4216	2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe	189

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_1045591681b11e496aec8bb417e6c1d3_akira_eternalromance_glassworm_ngrbot_quasar-rat.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query \"HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\" /v Identifier"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\reg.exe
    reg query \"HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0\" /v Identifier
    3⤵
    PID:2608
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query \"HKLM\HARDWARE\Description\System\SystemBiosInformation\" /v Identifier"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\system32\reg.exe
    reg query \"HKLM\HARDWARE\Description\System\SystemBiosInformation\" /v Identifier
    3⤵
    - Enumerates system info in registry
    PID:1792
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query \"HKLM\HARDWARE\Description\System\VideoBiosVersion\" /v Identifier"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\reg.exe
    reg query \"HKLM\HARDWARE\Description\System\VideoBiosVersion\" /v Identifier
    3⤵
    - Enumerates system info in registry
    PID:1888
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg query \"HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation\" /v Identifier"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\reg.exe
    reg query \"HKLM\SYSTEM\CurrentControlSet\Control\SystemInformation\" /v Identifier
    3⤵
    PID:4388
- C:\Windows\system32\cmd.exe
  "cmd" /C "getmac /v /fo csv"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\system32\getmac.exe
    getmac /v /fo csv
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeSystemCheck\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeSystemCheck\" /f
    3⤵
    PID:4728
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyeUpdate\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyeUpdate\" /f
    3⤵
    PID:224
- C:\Windows\system32\cmd.exe
  "cmd" /C "schtasks /delete /tn \"GoodbyePayload\" /f"
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn \"GoodbyePayload\" /f
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /C "netsh winhttp reset proxy"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\netsh.exe
    netsh winhttp reset proxy
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /C "reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\reg.exe
    reg add \"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\" /v ProxyEnable /t REG_DWORD /d 0 /f
    3⤵
    PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Clear-History
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil el"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\system32\wevtutil.exe
    wevtutil el
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AMSI/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AMSI/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"AirSpaceChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"AirSpaceChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Analytic\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Application\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Application\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowFilterGraph\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowFilterGraph\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"DirectShowPluginControl\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"DirectShowPluginControl\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Els_Hyphenation/Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Els_Hyphenation/Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"EndpointMapper\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"EndpointMapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"FirstUXPerf-Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"FirstUXPerf-Analytic\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"ForwardedEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"ForwardedEvents\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"General Logging\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"General Logging\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"HardwareEvents\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"HardwareEvents\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"IHM_DebugChannel\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"IHM_DebugChannel\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-GPIO/Analytic\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS-I2C/Analytic\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS-I2C/Analytic\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Debug\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-GPIO2/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Debug\""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Debug\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Intel-iaLPSS2-I2C/Performance\""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Intel-iaLPSS2-I2C/Performance\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Internet Explorer\""
  2⤵
  PID:1928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Internet Explorer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Key Management Service\""
  2⤵
  PID:4972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Key Management Service\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceMFT\""
  2⤵
  - Executes a command shell one-liner
  PID:876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceMFT\"
    3⤵
    PID:2736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationDeviceProxy\""
  2⤵
  PID:4612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationDeviceProxy\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MF_MediaFoundationFrameServer\""
  2⤵
  PID:4436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MF_MediaFoundationFrameServer\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProc\""
  2⤵
  PID:1920
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProc\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MedaFoundationVideoProcD3D\""
  2⤵
  PID:4576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MedaFoundationVideoProcD3D\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationAsyncWrapper\""
  2⤵
  - Executes a command shell one-liner
  PID:5004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationAsyncWrapper\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationContentProtection\""
  2⤵
  PID:448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationContentProtection\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDS\""
  2⤵
  PID:1100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDS\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationDeviceProxy\""
  2⤵
  PID:2564
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationDeviceProxy\"
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:3144
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMP4\""
  2⤵
  PID:3380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMP4\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationMediaEngine\""
  2⤵
  - Executes a command shell one-liner
  PID:2380
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationMediaEngine\"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformance\""
  2⤵
  PID:116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformance\"
    3⤵
    PID:4356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPerformanceCore\""
  2⤵
  PID:900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPerformanceCore\"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPipeline\""
  2⤵
  PID:2468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPipeline\"
    3⤵
    PID:1776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationPlatform\""
  2⤵
  - Executes a command shell one-liner
  PID:1580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationPlatform\"
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"MediaFoundationSrcPrefetch\""
  2⤵
  PID:656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"MediaFoundationSrcPrefetch\"
    3⤵
    - Clears Windows event logs
    PID:2892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\""
  2⤵
  PID:3772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client-Streamingux/Debug\"
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Admin\""
  2⤵
  PID:4864
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Admin\"
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Debug\""
  2⤵
  PID:4980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Debug\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Operational\""
  2⤵
  PID:3524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Operational\"
    3⤵
    PID:4000
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\""
  2⤵
  PID:3916
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-Client/Virtual Applications\"
    3⤵
    PID:1060
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\""
  2⤵
  PID:3852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-AppV-SharedPerformance/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\""
  2⤵
  PID:1276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Admin\"
    3⤵
    PID:5020
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\""
  2⤵
  PID:3272
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Debug\"
    3⤵
    PID:3544
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:3496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Client-Licensing-Platform/Diagnostic\"
    3⤵
    PID:4616
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IE/Diagnostic\""
  2⤵
  PID:492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IE/Diagnostic\"
    3⤵
    PID:220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-IEFRAME/Diagnostic\""
  2⤵
  PID:3664
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-IEFRAME/Diagnostic\"
    3⤵
    PID:4004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\""
  2⤵
  PID:2996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-JSDumpHeap/Diagnostic\"
    3⤵
    PID:1464
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-OneCore-Setup/Analytic\""
  2⤵
  PID:4084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-OneCore-Setup/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\""
  2⤵
  PID:2544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-IEFRAME/Diagnostic\"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-PerfTrack-MSHTML/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:2820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\""
  2⤵
  PID:4292
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Admin/Debug\"
    3⤵
    PID:860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\""
  2⤵
  PID:1052
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Debug\"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\""
  2⤵
  PID:2408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-Agent Driver/Operational\"
    3⤵
    PID:1484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\""
  2⤵
  PID:2188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:3716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\""
  2⤵
  PID:2160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Debug\"
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\""
  2⤵
  PID:3032
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-App Agent/Operational\"
    3⤵
    PID:1084
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\""
  2⤵
  PID:4276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-IPC/Operational\"
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\""
  2⤵
  PID:4200
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Analytic\"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\""
  2⤵
  PID:1996
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Debug\"
    3⤵
    PID:1780
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\""
  2⤵
  PID:408
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-User Experience Virtualization-SQM Uploader/Operational\"
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Analytic\""
  2⤵
  PID:4616
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Analytic\"
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AAD/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:216
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AAD/Operational\"
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ADSI/Debug\""
  2⤵
  PID:1196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ADSI/Debug\"
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ASN1/Operational\""
  2⤵
  PID:1844
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ASN1/Operational\"
    3⤵
    PID:4356
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/General\""
  2⤵
  - Executes a command shell one-liner
  PID:4760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/General\"
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\""
  2⤵
  - Executes a command shell one-liner
  PID:3964
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ATAPort/SATA-LPM\"
    3⤵
    PID:3992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\""
  2⤵
  PID:760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ActionQueue/Analytic\"
    3⤵
    PID:1012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:4756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-All-User-Install-Agent/Admin\"
    3⤵
    - Clears Windows event logs
    PID:4132
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AllJoyn/Debug\""
  2⤵
  PID:4752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AllJoyn/Debug\"
    3⤵
    PID:4988
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AllJoyn/Operational\""
  2⤵
  PID:3432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AllJoyn/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2816
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Admin\""
  2⤵
  PID:4792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Admin\"
    3⤵
    - Clears Windows event logs
    PID:1828
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\""
  2⤵
  PID:756
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/ApplicationTracing\"
    3⤵
    PID:1792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\""
  2⤵
  PID:2852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Diagnostic\"
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppHost/Internal\""
  2⤵
  PID:2320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppHost/Internal\"
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppID/Operational\""
  2⤵
  PID:3764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppID/Operational\"
    3⤵
    PID:2576
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\""
  2⤵
  PID:5020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/EXE and DLL\"
    3⤵
    - Clears Windows event logs
    PID:1692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\""
  2⤵
  PID:3544
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/MSI and Script\"
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\""
  2⤵
  PID:3144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Deployment\"
    3⤵
    PID:1176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\""
  2⤵
  PID:4924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppLocker/Packaged app-Execution\"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\""
  2⤵
  PID:4004
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Admin\"
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\""
  2⤵
  PID:2640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:2440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\""
  2⤵
  PID:1972
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Debug\"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\""
  2⤵
  PID:2280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-Runtime/Diagnostics\"
    3⤵
    PID:860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\""
  2⤵
  PID:2116
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Debug\"
    3⤵
    PID:892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\""
  2⤵
  PID:1648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppModel-State/Diagnostic\"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\""
  2⤵
  PID:2120
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Admin\"
    3⤵
    - Clears Windows event logs
    PID:3460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\""
  2⤵
  PID:1828
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Debug\"
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\""
  2⤵
  PID:1792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppReadiness/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppSruProv\""
  2⤵
  PID:4344
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppSruProv\"
    3⤵
    PID:524
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\""
  2⤵
  PID:4876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\""
  2⤵
  PID:4724
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeployment/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1692
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\""
  2⤵
  PID:1088
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Debug\"
    3⤵
    PID:2536
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\""
  2⤵
  PID:3960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Diagnostic\"
    3⤵
    PID:1680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\""
  2⤵
  PID:4644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1016
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\""
  2⤵
  PID:1192
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppXDeploymentServer/Restricted\"
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\""
  2⤵
  PID:464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Analytic\"
    3⤵
    PID:3316
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\""
  2⤵
  PID:2452
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ApplicabilityEngine/Operational\"
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\""
  2⤵
  PID:4868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Admin\"
    3⤵
    PID:1012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\""
  2⤵
  PID:2388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\""
  2⤵
  PID:3508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Debug\"
    3⤵
    PID:1772
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\""
  2⤵
  PID:3084
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application Server-Applications/Operational\"
    3⤵
    PID:4384
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\""
  2⤵
  PID:868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\""
  2⤵
  PID:4692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant\"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1900
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic\"
    3⤵
    PID:704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\""
  2⤵
  - Executes a command shell one-liner
  PID:4124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace\"
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\""
  2⤵
  PID:5072
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter\"
    3⤵
    PID:1736
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\""
  2⤵
  - Executes a command shell one-liner
  PID:3948
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Inventory\"
    3⤵
    PID:3444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\""
  2⤵
  PID:1516
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Program-Telemetry\"
    3⤵
    PID:3704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\""
  2⤵
  PID:1436
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Application-Experience/Steps-Recorder\"
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\""
  2⤵
  PID:3236
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Debug\"
    3⤵
    PID:4172
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\""
  2⤵
  PID:4164
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Operational\"
    3⤵
    PID:1876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\""
  2⤵
  PID:4316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AppxPackaging/Performance\"
    3⤵
    PID:3460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\""
  2⤵
  PID:1636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Admin\"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2736
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccess/Operational\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\""
  2⤵
  PID:4936
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Admin\"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\""
  2⤵
  PID:4212
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AssignedAccessBroker/Operational\"
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\""
  2⤵
  PID:1780
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AsynchronousCausality/Causality\"
    3⤵
    PID:3792
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\""
  2⤵
  PID:3808
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/CaptureMonitor\"
    3⤵
    - Clears Windows event logs
    PID:2104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\""
  2⤵
  PID:2644
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/GlitchDetection\"
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Informational\""
  2⤵
  PID:3444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Informational\"
    3⤵
    PID:740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Operational\""
  2⤵
  PID:3892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/Performance\""
  2⤵
  PID:732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/Performance\"
    3⤵
    PID:2820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\""
  2⤵
  PID:4720
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audio/PlaybackManager\"
    3⤵
    PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Audit/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Audit/Analytic\"
    3⤵
    PID:3460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\""
  2⤵
  PID:1156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication User Interface/Operational\"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\""
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController\"
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\""
  2⤵
  PID:4968
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUser-Client\"
    3⤵
    PID:4748
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\""
  2⤵
  PID:3068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController\"
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\""
  2⤵
  PID:2076
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController\"
    3⤵
    PID:392
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-AxInstallService/Log\""
  2⤵
  PID:2296
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-AxInstallService/Log\"
    3⤵
    PID:2104
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\""
  2⤵
  PID:3388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/HCI\"
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\""
  2⤵
  PID:1176
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHPORT/L2CAP\"
    3⤵
    PID:1700
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\""
  2⤵
  PID:820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Diagnostic\"
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\""
  2⤵
  PID:960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BTH-BTHUSB/Performance\"
    3⤵
    PID:3004
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\""
  2⤵
  PID:2396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic\"
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\""
  2⤵
  PID:3744
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTaskInfrastructure/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2420
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\""
  2⤵
  PID:1772
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational\"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Backup\""
  2⤵
  - Executes a command shell one-liner
  PID:4688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Backup\"
    3⤵
    PID:3128
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\""
  2⤵
  PID:3392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Connections/Operational\"
    3⤵
    PID:4396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\""
  2⤵
  PID:2480
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational\"
    3⤵
    PID:3656
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\""
  2⤵
  PID:3792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Battery/Diagnostic\"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:2956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Analytic\"
    3⤵
    PID:220
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Biometrics/Operational\""
  2⤵
  PID:1716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Biometrics/Operational\"
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\""
  2⤵
  PID:3532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Admin\"
    3⤵
    - Clears Windows event logs
    PID:552
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4364
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-DrivePreparationTool/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4172
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1876
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker-Driver-Performance/Operational\"
    3⤵
    PID:1952
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\""
  2⤵
  - Executes a command shell one-liner
  PID:860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Management\"
    3⤵
    PID:4112
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\""
  2⤵
  PID:4392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/BitLocker Operational\"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\""
  2⤵
  PID:4208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BitLocker/Tracing\"
    3⤵
    PID:428
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\""
  2⤵
  PID:3020
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Analytic\"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bits-Client/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1680
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\""
  2⤵
  PID:2124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational\"
    3⤵
    PID:2068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:220
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Bthmini/Operational\"
    3⤵
    PID:3940
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\""
  2⤵
  PID:224
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-MTPEnum/Operational\"
    3⤵
    PID:3476
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:5016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Bluetooth-Policy/Operational\"
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCache/Operational\""
  2⤵
  PID:2820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCache/Operational\"
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\""
  2⤵
  PID:1952
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic\"
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\""
  2⤵
  PID:1080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheEventProvider/Diagnostic\"
    3⤵
    PID:4444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\""
  2⤵
  PID:3156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheMonitoring/Analytic\"
    3⤵
    PID:1872
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4988
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Analytic\"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\""
  2⤵
  PID:1360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-BranchCacheSMB/Operational\"
    3⤵
    - Clears Windows event logs
    PID:4712
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\""
  2⤵
  PID:3612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Catalog Database Debug\"
    3⤵
    PID:4492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CAPI2/Operational\""
  2⤵
  PID:392
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CAPI2/Operational\"
    3⤵
    PID:5000
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CDROM/Operational\""
  2⤵
  PID:2180
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CDROM/Operational\"
    3⤵
    PID:2568
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:1752
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Analytic\"
    3⤵
    PID:1012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\""
  2⤵
  PID:552
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentInitialize\"
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\""
  2⤵
  PID:3512
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ApartmentUninitialize\"
    3⤵
    PID:2508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/Call\""
  2⤵
  PID:2264
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/Call\"
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/CreateInstance\""
  2⤵
  PID:2420
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/CreateInstance\"
    3⤵
    - Clears Windows event logs
    PID:360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\""
  2⤵
  PID:1040
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/ExtensionCatalog\"
    3⤵
    - Clears Windows event logs
    PID:4728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\""
  2⤵
  PID:2576
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/FreeUnusedLibrary\"
    3⤵
    - Clears Windows event logs
    PID:688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\""
  2⤵
  PID:3580
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COM/RundownInstrumentation\"
    3⤵
    PID:3484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\""
  2⤵
  PID:3940
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Activations\"
    3⤵
    - Clears Windows event logs
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\""
  2⤵
  PID:5024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/MessageProcessing\"
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\""
  2⤵
  PID:3208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-COMRuntime/Tracing\"
    3⤵
    - Clears Windows event logs
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\""
  2⤵
  PID:1776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertPoleEng/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4108
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational\"
    3⤵
    PID:3716
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\""
  2⤵
  PID:4908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational\"
    3⤵
    PID:4268
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\""
  2⤵
  PID:428
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational\"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\""
  2⤵
  PID:4396
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Cleanmgr/Diagnostic\"
    3⤵
    PID:688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\""
  2⤵
  PID:924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ClearTypeTextTuner/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Debug\"
    3⤵
    PID:704
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CloudStore/Operational\""
  2⤵
  PID:3228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CloudStore/Operational\"
    3⤵
    PID:3992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\""
  2⤵
  PID:3476
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CmiSetup/Analytic\"
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1856
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Operational\"
    3⤵
    PID:4956
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\""
  2⤵
  - Executes a command shell one-liner
  PID:3036
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CodeIntegrity/Verbose\"
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3024
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Analytic\"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\""
  2⤵
  PID:2928
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-ComDlg32/Debug\"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\""
  2⤵
  PID:4620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Analytic\"
    3⤵
    PID:3820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\""
  2⤵
  PID:4748
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Compat-Appraiser/Operational\"
    3⤵
    PID:3784
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:1016
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Debug\"
    3⤵
    - Clears Windows event logs
    PID:1852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\""
  2⤵
  PID:3304
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-BindFlt/Operational\"
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\""
  2⤵
  PID:4228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Debug\"
    3⤵
    PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcifs/Operational\"
    3⤵
    PID:1688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Debug\""
  2⤵
  PID:4000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Debug\"
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Operational\""
  2⤵
  PID:3124
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Containers-Wcnfs/Operational\"
    3⤵
    PID:980
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\""
  2⤵
  PID:4384
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Diagnostic\"
    3⤵
    PID:4168
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\""
  2⤵
  PID:3656
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\""
  2⤵
  PID:4188
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreApplication/Tracing\"
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\""
  2⤵
  PID:400
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug\"
    3⤵
    PID:2460
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\""
  2⤵
  PID:3992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational\"
    3⤵
    PID:3260
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\""
  2⤵
  PID:1012
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Analytic\"
    3⤵
    PID:4280
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:1992
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CoreWindow/Debug\"
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4444
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Client/Operational\"
    3⤵
    PID:1608
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\""
  2⤵
  PID:1872
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CorruptedFileRecovery-Server/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3528
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crashdump/Operational\""
  2⤵
  PID:4160
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crashdump/Operational\"
    3⤵
    PID:688
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\""
  2⤵
  PID:2792
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-CredUI/Diagnostic\"
    3⤵
    PID:4492
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\""
  2⤵
  PID:2904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-BCRYPT/Analytic\"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\""
  2⤵
  PID:1284
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-CNG/Analytic\"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\""
  2⤵
  PID:2520
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc\"
    3⤵
    PID:4636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\""
  2⤵
  PID:4156
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Debug\"
    3⤵
    PID:2648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\""
  2⤵
  PID:980
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DPAPI/Operational\"
    3⤵
    PID:1096
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3528
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-DSSEnh/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\""
  2⤵
  PID:688
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-NCrypt/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:3884
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RNG/Analytic\"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\""
  2⤵
  PID:228
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Crypto-RSAEnh/Analytic\"
    3⤵
    PID:3396
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\""
  2⤵
  PID:3260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/Analytic\"
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\""
  2⤵
  - Executes a command shell one-liner
  PID:5068
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-D3D10Level9/PerfTiming\"
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\""
  2⤵
  PID:2588
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Analytic\"
    3⤵
    PID:4388
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\""
  2⤵
  PID:2288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAL-Provider/Operational\"
    3⤵
    PID:4024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DAMM/Diagnostic\""
  2⤵
  PID:3128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DAMM/Diagnostic\"
    3⤵
    PID:1432
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DCLocator/Debug\""
  2⤵
  PID:3760
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DCLocator/Debug\"
    3⤵
    PID:4796
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\""
  2⤵
  PID:704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Analytic\"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DDisplay/Logging\""
  2⤵
  PID:3620
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DDisplay/Logging\"
    3⤵
    PID:3152
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\""
  2⤵
  PID:1704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DLNA-Namespace/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:2648
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\""
  2⤵
  PID:5064
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DNS-Client/Operational\"
    3⤵
    PID:4728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Admin\""
  2⤵
  PID:2536
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Admin\"
    3⤵
    PID:4740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Analytic\""
  2⤵
  PID:2448
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Analytic\"
    3⤵
    PID:548
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Debug\""
  2⤵
  PID:1700
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Debug\"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DSC/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:3704
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DSC/Operational\"
    3⤵
    PID:1868
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\""
  2⤵
  PID:4956
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUI/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:3504
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\""
  2⤵
  PID:1484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DUSER/Diagnostic\"
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Analytic\""
  2⤵
  PID:4128
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Analytic\"
    3⤵
    PID:4024
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXGI/Logging\""
  2⤵
  PID:5000
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXGI/Logging\"
    3⤵
    - Clears Windows event logs
    PID:740
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DXP/Analytic\""
  2⤵
  PID:4356
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DXP/Analytic\"
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:1868
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Data-Pdf/Debug\"
    3⤵
    - Clears Windows event logs
    PID:360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\""
  2⤵
  PID:1732
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/Admin\"
    3⤵
    - Clears Windows event logs
    PID:2508
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\""
  2⤵
  PID:3276
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DataIntegrityScan/CrashRecovery\"
    3⤵
    - Clears Windows event logs
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\""
  2⤵
  PID:5092
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Analytic\"
    3⤵
    PID:4532
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:3440
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Debug\"
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\""
  2⤵
  PID:1728
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DateTimeControlPanel/Operational\"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\""
  2⤵
  - Executes a command shell one-liner
  PID:4268
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Diagnostic\"
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4764
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2976
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Performance\""
  2⤵
  PID:3316
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Performance\"
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\""
  2⤵
  PID:548
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deduplication/Scrubbing\"
    3⤵
    - Clears Windows event logs
    PID:2892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\""
  2⤵
  PID:4584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Defrag-Core/Debug\"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\""
  2⤵
  PID:2816
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Deplorch/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\""
  2⤵
  PID:2600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopActivityModerator/Diagnostic\"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic\""
  2⤵
  PID:740
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DesktopWindowManager-Diag/Diagnostic\"
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\""
  2⤵
  PID:524
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceAssociationService/Performance\"
    3⤵
    PID:4348
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\""
  2⤵
  PID:3504
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceConfidence/Analytic\"
    3⤵
    PID:4796
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\""
  2⤵
  PID:2508
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Operational\"
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\""
  2⤵
  PID:3460
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceGuard/Verbose\"
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\""
  2⤵
  - Executes a command shell one-liner
  PID:4468
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin\"
    3⤵
    PID:360
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\""
  2⤵
  PID:4348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug\"
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4280
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\""
  2⤵
  PID:3712
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Admin\"
    3⤵
    - Clears Windows event logs
    PID:2496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\""
  2⤵
  PID:4800
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Analytic\"
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\""
  2⤵
  PID:2716
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Debug\"
    3⤵
    PID:1860
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\""
  2⤵
  PID:2056
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSetupManager/Operational\"
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\""
  2⤵
  PID:1692
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Analytic\"
    3⤵
    PID:2012
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\""
  2⤵
  PID:4172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceSync/Operational\"
    3⤵
    PID:2892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\""
  2⤵
  PID:5008
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUpdateAgent/Operational\"
    3⤵
    PID:4100
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\""
  2⤵
  - Executes a command shell one-liner
  PID:2352
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Informational\"
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\""
  2⤵
  PID:1908
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DeviceUx/Performance\"
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:2648
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Devices-Background/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\""
  2⤵
  PID:3456
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Admin\"
    3⤵
    PID:2028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4324
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcp-Client/Operational\"
    3⤵
    - Clears Windows event logs
    PID:2172
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\""
  2⤵
  PID:1432
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Admin\"
    3⤵
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\""
  2⤵
  PID:1472
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Dhcpv6-Client/Operational\"
    3⤵
    PID:4672
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\""
  2⤵
  PID:2612
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiagCpl/Debug\"
    3⤵
    PID:3820
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\""
  2⤵
  PID:1464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic\"
    3⤵
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4168
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Analytic\"
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:4672
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Debug\"
    3⤵
    PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\""
  2⤵
  PID:2028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-DPS/Operational\"
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\""
  2⤵
  PID:2568
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-MSDE/Debug\"
    3⤵
    PID:4776
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\""
  2⤵
  PID:4532
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Analytic\"
    3⤵
    PID:2080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:3288
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Debug\"
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\""
  2⤵
  PID:2140
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PCW/Operational\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\""
  2⤵
  PID:2080
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Debug\"
    3⤵
    - Clears Windows event logs
    PID:4904
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:3368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-PLA/Operational\"
    3⤵
    PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Perfhost/Analytic\""
  2⤵
  PID:1260
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Perfhost/Analytic\"
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:1860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scheduled/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3320
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\""
  2⤵
  PID:4388
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Admin\"
    3⤵
    PID:3924
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\""
  2⤵
  PID:2608
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Analytic\"
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\""
  2⤵
  PID:4100
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Debug\"
    3⤵
    PID:2848
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-Scripted/Operational\"
    3⤵
    PID:4852
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\""
  2⤵
  PID:2196
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug\"
    3⤵
    PID:4728
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\""
  2⤵
  PID:2172
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational\"
    3⤵
    - Clears Windows event logs
    PID:3520
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\""
  2⤵
  PID:4144
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDC/Analytic\"
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\""
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnosis-WDI/Debug\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\""
  2⤵
  PID:2584
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Debug\"
    3⤵
    PID:3028
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\""
  2⤵
  - Executes a command shell one-liner
  PID:3820
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Networking/Operational\"
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic\""
  2⤵
  PID:3320
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\""
  2⤵
  PID:3784
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic\"
    3⤵
    - Clears Windows event logs
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\""
  2⤵
  PID:4804
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic\"
    3⤵
    PID:4484
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\""
  2⤵
  PID:4860
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback\"
    3⤵
    PID:3876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\""
  2⤵
  PID:4368
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Diagnostics-Performance/Operational\"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\""
  2⤵
  PID:1348
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10/Analytic\"
    3⤵
    PID:636
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\""
  2⤵
  - Executes a command shell one-liner
  PID:4776
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D10_1/Analytic\"
    3⤵
    PID:4624
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\""
  2⤵
  PID:360
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4372
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\""
  2⤵
  PID:2496
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/Logging\"
    3⤵
    PID:1892
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\""
  2⤵
  PID:2960
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D11/PerfTiming\"
    3⤵
    PID:2948
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\""
  2⤵
  PID:2976
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Analytic\"
    3⤵
    PID:3768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\""
  2⤵
  PID:4484
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/Logging\"
    3⤵
    - Clears Windows event logs
    PID:3876
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\""
  2⤵
  PID:1208
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D12/PerfTiming\"
    3⤵
    PID:5080
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\""
  2⤵
  PID:4492
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3D9/Analytic\"
    3⤵
    - Clears Windows event logs
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\""
  2⤵
  PID:4636
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Direct3DShaderCache/Default\"
    3⤵
    - Clears Windows event logs
    PID:3768
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\""
  2⤵
  PID:640
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectComposition/Diagnostic\"
    3⤵
    PID:4068
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\""
  2⤵
  PID:1892
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectManipulation/Diagnostic\"
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\""
  2⤵
  PID:1852
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectShow-KernelSupport/Performance\"
    3⤵
    PID:2848
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DirectSound/Debug\""
  2⤵
  PID:3028
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DirectSound/Debug\"
    3⤵
    PID:4844
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-Disk/Operational\""
  2⤵
  PID:2464
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-Disk/Operational\"
    3⤵
    PID:1652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\""
  2⤵
  PID:4904
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnostic/Operational\"
    3⤵
    PID:4180
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\""
  2⤵
  PID:3924
- - C:\Windows\system32\wevtutil.exe
    wevtutil cl \"Microsoft-Windows-DiskDiagnosticDataCollector/Operational\"
    3⤵
    - Clears Windows event logs
    PID:1652
- C:\Windows\system32\cmd.exe
  "cmd" /C "wevtutil cl \"Microsoft-Windows-DiskDiagnosticResolver/Operational\""
  2⤵
  PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_sq2eelfs.qh1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sq2eelfs.qh1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

goodbye.log

Path C:\Windows\Temp\goodbye.log
Size 2KB
SHA256 cdd0bdd3be8cdb098ebf2f4aeeb4deb444e979227356f195e24635df7322b4a3
MD5 7b9b255607a6858e2c1150d318e2d11c
SHA1 a1a134048c7501ff5a6570830252221d31f64dff
SHA512 dc633a9d0e72f1ca5218c33b318af0b21f72ed126eef607ce874529c32a9829ee33af69d5b36a058a87a3d4aa0e2fc71a49b559f9fdf8b07c2728af9a24ff658
TLSH
T14D51ACB435E433A21FB29152B008EA0D431C63FBFAF98B96F1CE29006F58E14C9804F4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3500-17-0x00000191340B0000-0x00000191340D2000-memory.dmp

Download

memory/4216-23-0x00007FF6062A0000-0x00007FF606A49000-memory.dmp

Download