33f6374aeb29cc95dfc7b43c58e961a35c9864c60b9ca3e99ab5368ad469cb39

Analysis

user interaction
yes
max time kernel
80s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
baj.exe
Size 71KB
Sample260919-nc1rxabl4s
SHA256 33f6374aeb29cc95dfc7b43c58e961a35c9864c60b9ca3e99ab5368ad469cb39
MD5 aac4570979e8565cf7e963e98d77ed2f
SHA1 0aa30db41310b5567f6636361af36cb7c7c71d30
SHA512 b6ee58d37f57dafadc257dafb6fd9145b84635551b48d87929a0920826459bec1be0b166c794a99ae1eae37dbc6821849b379553fbd49cdc5c5af9a33d92f72f
SSDEEP 1536:REPK013BPr5Ln9OVaHG8tfnGpcSIvMVkGGFj/5ouRjnouy8Y:RelXtLUVaHrhKvIvnJoCbout
TLSH
T1E763021BC2400D65D9B268B548DFFF1E04B0BC2E2727D757BAEB32BB02366E45445647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Program Files (x86)\a7k9p2q-ReadMe.txt

Ransom Note

>>> All your important files have been ENCRYPTED <<< - The only way for restoring your files is through purchase of decryption software from us. - To restore your files, contact us by email. - Send your ID to all addresses below to get the fastest response client ID --> 3BSRZKH241ZJZENM In order to start negotiations, Send message to our mailboxes: - [email protected] - [email protected] >>> Your client ID:3BSRZKH241ZJZENM <<< Important Warnings: - Do not contact data recovery companies. They are middlemen who will charge you much more and scam you. - The sooner you contact us, the lower the recovery cost. - Do not rename, modify, or delete any encrypted files — doing so can make recovery impossible. - Do not use third-party tools to decrypt files. This will damage your data and make recovery permanently impossible. Time is critical. Send your ID to all email addresses for the quickest help.

Emails

Signatures

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
816	wevtutil.exe
4856	wevtutil.exe
2464	wevtutil.exe
1400	wevtutil.exe
5288	wevtutil.exe
4296	wevtutil.exe
4192	wevtutil.exe
2800	wevtutil.exe
3668	wevtutil.exe
5032	wevtutil.exe
2000	wevtutil.exe
5404	wevtutil.exe
3740	wevtutil.exe
4924	wevtutil.exe
5580	wevtutil.exe
1836	wevtutil.exe
1440	wevtutil.exe
1084	wevtutil.exe
1540	wevtutil.exe
3940	wevtutil.exe
3268	wevtutil.exe
1540	wevtutil.exe
3296	wevtutil.exe
3340	wevtutil.exe
4172	wevtutil.exe
2640	wevtutil.exe
2512	wevtutil.exe
1440	wevtutil.exe
1776	wevtutil.exe
4556	wevtutil.exe
4248	wevtutil.exe
3668	wevtutil.exe
4340	wevtutil.exe
5256	wevtutil.exe
4864	wevtutil.exe
600	wevtutil.exe
3920	wevtutil.exe
804	wevtutil.exe
2728	wevtutil.exe
5824	wevtutil.exe
1984	wevtutil.exe
5908	wevtutil.exe
2288	wevtutil.exe
4692	wevtutil.exe
1388	wevtutil.exe
2120	wevtutil.exe
4836	wevtutil.exe
2608	wevtutil.exe
2212	wevtutil.exe
3324	wevtutil.exe
5108	wevtutil.exe
3316	wevtutil.exe
2884	wevtutil.exe
5724	wevtutil.exe
4484	wevtutil.exe
4964	wevtutil.exe
5136	wevtutil.exe
3796	wevtutil.exe
120	wevtutil.exe
3956	wevtutil.exe
860	wevtutil.exe
5704	wevtutil.exe
332	wevtutil.exe
4792	wevtutil.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	Culture.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini	baj.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	baj.exe
File opened (read-only)	\??\G:	baj.exe
File opened (read-only)	\??\K:	baj.exe
File opened (read-only)	\??\L:	baj.exe
File opened (read-only)	\??\O:	baj.exe
File opened (read-only)	\??\W:	baj.exe
File opened (read-only)	\??\Y:	baj.exe
File opened (read-only)	\??\E:	baj.exe
File opened (read-only)	\??\N:	baj.exe
File opened (read-only)	\??\Q:	baj.exe
File opened (read-only)	\??\Z:	baj.exe
File opened (read-only)	\??\A:	baj.exe
File opened (read-only)	\??\I:	baj.exe
File opened (read-only)	\??\J:	baj.exe
File opened (read-only)	\??\P:	baj.exe
File opened (read-only)	\??\T:	baj.exe
File opened (read-only)	\??\X:	baj.exe
File opened (read-only)	\??\F:	baj.exe
File opened (read-only)	\??\B:	baj.exe
File opened (read-only)	\??\D:	baj.exe
File opened (read-only)	\??\H:	baj.exe
File opened (read-only)	\??\M:	baj.exe
File opened (read-only)	\??\R:	baj.exe
File opened (read-only)	\??\S:	baj.exe
File opened (read-only)	\??\U:	baj.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "a7k9p2q Ransomware"	baj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "\r\nAll your files are stolen and encrypted\r\nFind a7k9p2q-ReadMe.txt file\r\nand follow instructions"	baj.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4264	wevtutil.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\a7k9p2q.bmp"	baj.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1028-0-0x0000000000060000-0x0000000000096000-memory.dmp	upx
behavioral2/memory/4116-1315-0x0000000000060000-0x0000000000096000-memory.dmp	upx
behavioral2/memory/1028-2356-0x0000000000060000-0x0000000000096000-memory.dmp	upx
behavioral2/memory/1028-2738-0x0000000000060000-0x0000000000096000-memory.dmp	upx
behavioral2/memory/1028-6451-0x0000000000060000-0x0000000000096000-memory.dmp	upx
behavioral2/memory/1028-10724-0x0000000000060000-0x0000000000096000-memory.dmp	upx
behavioral2/memory/1028-10734-0x0000000000060000-0x0000000000096000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\Ium9VoTr0J.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.INF	baj.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado25.tlb	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\it-it\ui-strings.js	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\OGdjJZIzy0.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\changelog.txt	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Wmj526lGBD.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui	baj.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat	baj.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\a7k9p2q-ReadMe.txt	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\wzTmGoFezJ.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h2x.png	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\flags.png	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg	baj.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\a7k9p2q-ReadMe.txt	baj.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\a7k9p2q-ReadMe.txt	baj.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\a7k9p2q-ReadMe.txt	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\T0ZIaWbNqO.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\outlookmui.msi.16.en-us.boot.tree.dat	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-focus_32.svg	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\EMkKa7flWC.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\wZoZBLDFZK.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SGLhPbX0GE.a7k9p2q	baj.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\a7k9p2q-ReadMe.txt	baj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\57yDIpWBdP.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\nEzxrHHhCr.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\9rHvKqAWxV.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\9NaImAzpbg.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ja-jp\ZNci29CoSl.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\ui-strings.js	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\3Nqc1a7mEy.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\NNjI2ay1kt.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\BHi0dxBZ2a.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\0PzEU0eoTl.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Assets\FirstRunIllustration.theme-light.png	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\KuDpxQdsOa.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms	baj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\BapMD65h9S.a7k9p2q	baj.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\a7k9p2q-ReadMe.txt	baj.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\de-DE\a7k9p2q-ReadMe.txt	baj.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\a7k9p2q-ReadMe.txt	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml	baj.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\ZhkpBLkujV.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\jlj9ouykYx.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\ui-strings.js	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AAGyjjpL7X.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\103LuoPQHN.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\oq5MKzU1Wr.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\qp0upbZ5NE.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\olWJNgMPPg.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\3SqD2Bs4jD.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\IBYLgT8zOY.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\CUXgYVOVoK.a7k9p2q	baj.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\vstoee90.tlb	baj.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\bFeDO4PnUR.a7k9p2q	baj.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\a7k9p2q-ReadMe.txt	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ru-ru\7ZDGNKLNeW.a7k9p2q	baj.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy	baj.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityAppList.targetsize-48_altform-lightunplated_contrast-white.png	baj.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reportabuse-default_18.svg	baj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2624	cmd.exe
2216	cmd.exe
692	cmd.exe
312	cmd.exe
4956	cmd.exe
5152	cmd.exe
4640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	baj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Culture.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wevtutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2216	cmd.exe
312	cmd.exe
2796	PING.EXE
684	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
600	wevtutil.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\WallpaperStyle = "2"	baj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\TileWallpaper = "0"	baj.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2796	PING.EXE
684	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4136	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	baj.exe
Token: SeRestorePrivilege	1028	baj.exe
Token: SeBackupPrivilege	1028	baj.exe
Token: SeTakeOwnershipPrivilege	1028	baj.exe
Token: SeAuditPrivilege	1028	baj.exe
Token: SeSecurityPrivilege	1028	baj.exe
Token: SeIncBasePriorityPrivilege	1028	baj.exe
Token: SeBackupPrivilege	4088	vssvc.exe
Token: SeRestorePrivilege	4088	vssvc.exe
Token: SeAuditPrivilege	4088	vssvc.exe
Token: SeDebugPrivilege	4116	baj.exe
Token: SeRestorePrivilege	4116	baj.exe
Token: SeBackupPrivilege	4116	baj.exe
Token: SeTakeOwnershipPrivilege	4116	baj.exe
Token: SeAuditPrivilege	4116	baj.exe
Token: SeSecurityPrivilege	4116	baj.exe
Token: SeIncBasePriorityPrivilege	4116	baj.exe
Token: SeSecurityPrivilege	4132	wevtutil.exe
Token: SeBackupPrivilege	4132	wevtutil.exe
Token: SeSecurityPrivilege	2372	wevtutil.exe
Token: SeBackupPrivilege	2372	wevtutil.exe
Token: SeSecurityPrivilege	4684	wevtutil.exe
Token: SeBackupPrivilege	4684	wevtutil.exe
Token: SeSecurityPrivilege	1752	wevtutil.exe
Token: SeBackupPrivilege	1752	wevtutil.exe
Token: SeSecurityPrivilege	1924	wevtutil.exe
Token: SeBackupPrivilege	1924	wevtutil.exe
Token: SeSecurityPrivilege	4244	wevtutil.exe
Token: SeBackupPrivilege	4244	wevtutil.exe
Token: SeSecurityPrivilege	684	wevtutil.exe
Token: SeBackupPrivilege	684	wevtutil.exe
Token: SeSecurityPrivilege	4700	wevtutil.exe
Token: SeBackupPrivilege	4700	wevtutil.exe
Token: SeSecurityPrivilege	3316	wevtutil.exe
Token: SeBackupPrivilege	3316	wevtutil.exe
Token: SeSecurityPrivilege	1124	wevtutil.exe
Token: SeBackupPrivilege	1124	wevtutil.exe
Token: SeSecurityPrivilege	4256	wevtutil.exe
Token: SeBackupPrivilege	4256	wevtutil.exe
Token: SeSecurityPrivilege	120	wevtutil.exe
Token: SeBackupPrivilege	120	wevtutil.exe
Token: SeSecurityPrivilege	3720	wevtutil.exe
Token: SeBackupPrivilege	3720	wevtutil.exe
Token: SeSecurityPrivilege	4960	wevtutil.exe
Token: SeBackupPrivilege	4960	wevtutil.exe
Token: SeSecurityPrivilege	3440	wevtutil.exe
Token: SeBackupPrivilege	3440	wevtutil.exe
Token: SeSecurityPrivilege	5288	wevtutil.exe
Token: SeBackupPrivilege	5288	wevtutil.exe
Token: SeSecurityPrivilege	5376	wevtutil.exe
Token: SeBackupPrivilege	5376	wevtutil.exe
Token: SeSecurityPrivilege	4504	wevtutil.exe
Token: SeBackupPrivilege	4504	wevtutil.exe
Token: SeSecurityPrivilege	2208	wevtutil.exe
Token: SeBackupPrivilege	2208	wevtutil.exe
Token: SeSecurityPrivilege	4484	wevtutil.exe
Token: SeBackupPrivilege	4484	wevtutil.exe
Token: SeSecurityPrivilege	4976	wevtutil.exe
Token: SeBackupPrivilege	4976	wevtutil.exe
Token: SeSecurityPrivilege	4100	wevtutil.exe
Token: SeBackupPrivilege	4100	wevtutil.exe
Token: SeSecurityPrivilege	1144	wevtutil.exe
Token: SeBackupPrivilege	1144	wevtutil.exe
Token: SeSecurityPrivilege	3356	wevtutil.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4956	1028	baj.exe	90
PID 4956 wrote to memory of 4136	4956	cmd.exe	92
PID 1028 wrote to memory of 5152	1028	baj.exe	100
PID 5152 wrote to memory of 3964	5152	cmd.exe	102
PID 1028 wrote to memory of 4640	1028	baj.exe	103
PID 1028 wrote to memory of 2624	1028	baj.exe	104
PID 1028 wrote to memory of 2216	1028	baj.exe	105
PID 4640 wrote to memory of 5556	4640	cmd.exe	564
PID 2624 wrote to memory of 692	2624	cmd.exe	110
PID 692 wrote to memory of 4132	692	cmd.exe	111
PID 2624 wrote to memory of 2372	2624	cmd.exe	607
PID 2624 wrote to memory of 4684	2624	cmd.exe	113
PID 2624 wrote to memory of 1752	2624	cmd.exe	609
PID 2624 wrote to memory of 1924	2624	cmd.exe	115
PID 2624 wrote to memory of 4244	2624	cmd.exe	339
PID 2624 wrote to memory of 684	2624	cmd.exe	219
PID 2624 wrote to memory of 4700	2624	cmd.exe	469
PID 2624 wrote to memory of 3316	2624	cmd.exe	119
PID 2624 wrote to memory of 1124	2624	cmd.exe	120
PID 2624 wrote to memory of 4256	2624	cmd.exe	121
PID 2624 wrote to memory of 120	2624	cmd.exe	474
PID 2624 wrote to memory of 3720	2624	cmd.exe	628
PID 2624 wrote to memory of 4960	2624	cmd.exe	124
PID 2624 wrote to memory of 3440	2624	cmd.exe	125
PID 2624 wrote to memory of 5288	2624	cmd.exe	636
PID 2624 wrote to memory of 5376	2624	cmd.exe	127
PID 2624 wrote to memory of 4504	2624	cmd.exe	361
PID 2624 wrote to memory of 2208	2624	cmd.exe	129
PID 2624 wrote to memory of 4484	2624	cmd.exe	642
PID 2624 wrote to memory of 4976	2624	cmd.exe	131
PID 2624 wrote to memory of 4100	2624	cmd.exe	132
PID 2624 wrote to memory of 1144	2624	cmd.exe	133
PID 2624 wrote to memory of 3356	2624	cmd.exe	134
PID 2624 wrote to memory of 3536	2624	cmd.exe	368
PID 2624 wrote to memory of 3048	2624	cmd.exe	369
PID 2624 wrote to memory of 3268	2624	cmd.exe	370
PID 2624 wrote to memory of 1288	2624	cmd.exe	138
PID 2624 wrote to memory of 3168	2624	cmd.exe	652
PID 2624 wrote to memory of 5316	2624	cmd.exe	655
PID 2624 wrote to memory of 2196	2624	cmd.exe	506
PID 2624 wrote to memory of 3008	2624	cmd.exe	656
PID 2624 wrote to memory of 3840	2624	cmd.exe	509
PID 2624 wrote to memory of 3844	2624	cmd.exe	510
PID 2624 wrote to memory of 5840	2624	cmd.exe	258
PID 2624 wrote to memory of 2368	2624	cmd.exe	146
PID 2624 wrote to memory of 5156	2624	cmd.exe	512
PID 2624 wrote to memory of 4896	2624	cmd.exe	148
PID 2624 wrote to memory of 336	2624	cmd.exe	662
PID 2624 wrote to memory of 1440	2624	cmd.exe	664
PID 2624 wrote to memory of 4516	2624	cmd.exe	264
PID 2624 wrote to memory of 5220	2624	cmd.exe	669
PID 2624 wrote to memory of 1344	2624	cmd.exe	153
PID 2624 wrote to memory of 4620	2624	cmd.exe	154
PID 2624 wrote to memory of 2984	2624	cmd.exe	674
PID 2624 wrote to memory of 3956	2624	cmd.exe	526
PID 2624 wrote to memory of 3580	2624	cmd.exe	527
PID 2624 wrote to memory of 3344	2624	cmd.exe	528
PID 2624 wrote to memory of 1824	2624	cmd.exe	677
PID 2624 wrote to memory of 4392	2624	cmd.exe	273
PID 2624 wrote to memory of 1700	2624	cmd.exe	274
PID 2624 wrote to memory of 5108	2624	cmd.exe	275
PID 2624 wrote to memory of 3760	2624	cmd.exe	683
PID 2624 wrote to memory of 3424	2624	cmd.exe	277

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\baj.exe
"C:\Users\Admin\AppData\Local\Temp\baj.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update BETA" /TR "C:\Users\Admin\AppData\Local\Temp\baj.exe" /F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS.exe /Create /RU "NT AUTHORITY\SYSTEM" /sc onstart /TN "Windows Update BETA" /TR "C:\Users\Admin\AppData\Local\Temp\baj.exe" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Culture.tmp"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5152
- - C:\ProgramData\Culture.tmp
    C:\ProgramData\Culture.tmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3964
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 -n 5 > nul & del "C:\ProgramData\Culture.tmp"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:312
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /Delete /TN "Windows Update BETA" /F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS.exe /Delete /TN "Windows Update BETA" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c for /f "tokens=*" %1 in ('wevtutil el') do wevtutil cl "%1"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil el
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil el
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "AMSI/Debug"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "AirSpaceChannel"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Analytic"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Application"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "DirectShowFilterGraph"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "DirectShowPluginControl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:684
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Els_Hyphenation/Analytic"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "EndpointMapper"
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "FirstUXPerf-Analytic"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "ForwardedEvents"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "General Logging"
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:120
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "HardwareEvents"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "IHM_DebugChannel"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Intel-iaLPSS-GPIO/Analytic"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Intel-iaLPSS-I2C/Analytic"
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-GPIO2/Debug"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-GPIO2/Performance"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-I2C/Debug"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Intel-iaLPSS2-I2C/Performance"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Internet Explorer"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Key Management Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MF_DshowReverseBridge"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MF_MediaFoundationDeviceMFT"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MF_MediaFoundationDeviceProxy"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MF_MediaFoundationFrameServer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MedaFoundationVideoProc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MedaFoundationVideoProcD3D"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationAsyncWrapper"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3168
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationContentProtection"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationDS"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationDeviceProxy"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationMP4"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationMediaEngine"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3844
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationPerformance"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationPerformanceCore"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationPipeline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5156
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationPlatform"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4896
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "MediaFoundationSrcPrefetch"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client-Streamingux/Debug"
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    PID:1440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Admin"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Debug"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Operational"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-AppV-Client/Virtual Applications"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-AppV-SharedPerformance/Analytic"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Client-License-Flexible-Platform/Admin"
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    PID:3956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Client-License-Flexible-Platform/Debug"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Client-License-Flexible-Platform/Diagnostic"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Admin"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Debug"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Client-Licensing-Platform/Diagnostic"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1700
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-IE/Diagnostic"
    3⤵
    - Clears Windows event logs
    - System Location Discovery: System Language Discovery
    PID:5108
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3424
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-OneCore-Setup/Analytic"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-System-Diagnostics-DiagnosticInvoker/Operational"
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Admin/Debug"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Debug"
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-Agent Driver/Operational"
    3⤵
    PID:432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Analytic"
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Debug"
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-App Agent/Operational"
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-IPC/Operational"
    3⤵
    PID:804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Debug"
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-User Experience Virtualization-SQM Uploader/Operational"
    3⤵
    - Clears Windows event logs
    PID:860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AAD/Analytic"
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AAD/Operational"
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ASN1/Operational"
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ATAPort/General"
    3⤵
    - Clears Windows event logs
    PID:4172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AccelLib-AccelCx/Operational"
    3⤵
    - Clears Windows event logs
    PID:4340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-All-User-Install-Agent/Admin"
    3⤵
    PID:3480
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Admin"
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/ApplicationTracing"
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Diagnostic"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppHost/Internal"
    3⤵
    - Clears Windows event logs
    PID:2884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Deployment"
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Packaged app-Execution"
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppLocker/Verbose"
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Admin"
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Analytic"
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Debug"
    3⤵
    PID:5092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-Runtime/Diagnostics"
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-State/Debug"
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppModel-State/Diagnostic"
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Admin"
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Debug"
    3⤵
    - Clears Windows event logs
    PID:2120
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppReadiness/Operational"
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppSruProv"
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeployment/Diagnostic"
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeployment/Operational"
    3⤵
    PID:2948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Debug"
    3⤵
    PID:1200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Diagnostic"
    3⤵
    PID:5580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Operational"
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppXDeploymentServer/Restricted"
    3⤵
    - Clears Windows event logs
    PID:1084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Analytic"
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ApplicabilityEngine/Operational"
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Analytic"
    3⤵
    PID:6116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Debug"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    PID:3868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Compatibility-Infrastructure-Debug"
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant/Trace"
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Inventory"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Application-Experience/Steps-Recorder"
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Debug"
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Operational"
    3⤵
    PID:5340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AppxPackaging/Performance"
    3⤵
    PID:4804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccess/Admin"
    3⤵
    PID:2020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccess/Operational"
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Admin"
    3⤵
    PID:788
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AssignedAccessBroker/Operational"
    3⤵
    PID:328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AsynchronousCausality/Causality"
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/CaptureMonitor"
    3⤵
    - Clears Windows event logs
    PID:5724
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/GlitchDetection"
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Informational"
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Operational"
    3⤵
    PID:716
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/Performance"
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audio/PlaybackManager"
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Audit/Analytic"
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/AuthenticationPolicyFailures-DomainController"
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUser-Client"
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController"
    3⤵
    - Clears Windows event logs
    PID:5908
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController"
    3⤵
    PID:308
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-AxInstallService/Log"
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHPORT/HCI"
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHPORT/L2CAP"
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Diagnostic"
    3⤵
    PID:5540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BTH-BTHUSB/Performance"
    3⤵
    PID:316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Diagnostic"
    3⤵
    PID:4608
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTaskInfrastructure/Operational"
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BackgroundTransfer-ContentPrefetcher/Operational"
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Backup"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Connections/Operational"
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Base-Filtering-Engine-Resource-Flows/Operational"
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Battery/Diagnostic"
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Biometrics/Analytic"
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Biometrics/Operational"
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker-Driver-Performance/Operational"
    3⤵
    PID:992
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Management"
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/BitLocker Operational"
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BitLocker/Tracing"
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bits-Client/Analytic"
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bits-Client/Operational"
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-BthLEPrepairing/Operational"
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-Bthmini/Operational"
    3⤵
    PID:5108
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Bluetooth-Policy/Operational"
    3⤵
    PID:3424
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCache/Operational"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheMonitoring/Analytic"
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheSMB/Analytic"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-BranchCacheSMB/Operational"
    3⤵
    - Clears Windows event logs
    PID:2640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CAPI2/Catalog Database Debug"
    3⤵
    PID:432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CAPI2/Operational"
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CDROM/Operational"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/Analytic"
    3⤵
    PID:2664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ApartmentInitialize"
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ApartmentUninitialize"
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/Call"
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/CreateInstance"
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/ExtensionCatalog"
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/FreeUnusedLibrary"
    3⤵
    PID:860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COM/RundownInstrumentation"
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/Activations"
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/MessageProcessing"
    3⤵
    PID:240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-COMRuntime/Tracing"
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Calculator/Debug"
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Calculator/Diagnostic"
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertPoleEng/Operational"
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
    3⤵
    - Clears Windows event logs
    PID:1540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational"
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Cleanmgr/Diagnostic"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudFiles-Filter/Debug"
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudFiles-Filter/Operational"
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudRestoreLauncher/Operational"
    3⤵
    - Clears Windows event logs
    PID:2512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Debug"
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Initialization"
    3⤵
    PID:5124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CloudStore/Operational"
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CmiSetup/Analytic"
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CodeIntegrity/Operational"
    3⤵
    - Clears Windows event logs
    PID:4836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CodeIntegrity/Verbose"
    3⤵
    PID:324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ComDlg32/Analytic"
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ComDlg32/Debug"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Compat-Appraiser/Analytic"
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Compat-Appraiser/Operational"
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-BindFlt/Debug"
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-BindFlt/Operational"
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-Wcifs/Debug"
    3⤵
    PID:708
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Containers-Wcifs/Operational"
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Diagnostic"
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Operational"
    3⤵
    PID:5512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreApplication/Tracing"
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Debug"
    3⤵
    PID:4636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreSystem-SmsRouter-Events/Operational"
    3⤵
    - Clears Windows event logs
    PID:4192
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreWindow/Analytic"
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CoreWindow/Debug"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
    3⤵
    PID:4848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crashdump/Analytic"
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crashdump/Operational"
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-CredUI/Diagnostic"
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-BCRYPT/Analytic"
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-CNG/Analytic"
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/BackUpKeySvc"
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Debug"
    3⤵
    PID:4244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DPAPI/Operational"
    3⤵
    - Clears Windows event logs
    PID:3920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-DSSEnh/Analytic"
    3⤵
    PID:6116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/CertInUse"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/KeyMgmt"
    3⤵
    PID:3868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-NCrypt/Operational"
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-RNG/Analytic"
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Crypto-RSAEnh/Analytic"
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-D3D10Level9/Analytic"
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-D3D10Level9/PerfTiming"
    3⤵
    PID:1096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAL-Provider/Analytic"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DAL-Provider/Operational"
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DCLocator/Debug"
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DDisplay/Analytic"
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DDisplay/Logging"
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DLNA-Namespace/Analytic"
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DNS-Client/Operational"
    3⤵
    - Clears Windows event logs
    PID:5704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Admin"
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Analytic"
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Debug"
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DSC/Operational"
    3⤵
    PID:816
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DUI/Diagnostic"
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DUSER/Diagnostic"
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXGI/Analytic"
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXGI/Logging"
    3⤵
    PID:480
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DXP/Analytic"
    3⤵
    - Clears Windows event logs
    PID:3940
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Data-Pdf/Debug"
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DataIntegrityScan/Admin"
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DataIntegrityScan/CrashRecovery"
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Debug"
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DateTimeControlPanel/Operational"
    3⤵
    - Clears Windows event logs
    PID:3268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Diagnostic"
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Operational"
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Performance"
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deduplication/Scrubbing"
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Defrag-Core/Debug"
    3⤵
    PID:5800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Deplorch/Analytic"
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DesktopActivityModerator/Diagnostic"
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceAssociationService/Performance"
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceConfidence/Analytic"
    3⤵
    - Clears Windows event logs
    PID:2000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceGuard/Operational"
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceGuard/Verbose"
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot"
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug"
    3⤵
    PID:484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
    3⤵
    - Clears Windows event logs
    PID:5256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Admin"
    3⤵
    - Clears Windows event logs
    PID:4864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Analytic"
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Debug"
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSetupManager/Operational"
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSync/Analytic"
    3⤵
    PID:616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceSync/Operational"
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUpdateAgent/Operational"
    3⤵
    - Clears Windows event logs
    PID:5404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUx/Informational"
    3⤵
    - Clears Windows event logs
    PID:2800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DeviceUx/Performance"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Devices-Background/Operational"
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Devices-Query/Performance"
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcp-Client/Admin"
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcp-Client/Operational"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Admin"
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dhcpv6-Client/Operational"
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiagCpl/Debug"
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-AdvancedTaskManager/Analytic"
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Debug"
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-DPS/Operational"
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
    3⤵
    PID:5820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
    3⤵
    PID:4444
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Debug"
    3⤵
    - Clears Windows event logs
    PID:804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PCW/Operational"
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Debug"
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-PLA/Operational"
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
    3⤵
    - Clears Windows event logs
    PID:3740
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnosis-WDI/Debug"
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Debug"
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Networking/Operational"
    3⤵
    PID:832
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Diagnostics-Performance/Operational"
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D10/Analytic"
    3⤵
    PID:2848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D10_1/Analytic"
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/Analytic"
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/Logging"
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D11/PerfTiming"
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/Analytic"
    3⤵
    PID:948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/Logging"
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D12/PerfTiming"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3D9/Analytic"
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Direct3DShaderCache/Default"
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectComposition/Diagnostic"
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectManipulation/Diagnostic"
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DirectSound/Debug"
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Disk/Operational"
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnostic/Operational"
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
    3⤵
    PID:568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/Analytic"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/ExternalAnalytic"
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Api/InternalAnalytic"
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dism-Cli/Analytic"
    3⤵
    PID:4664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Debug"
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplayColorCalibration/Operational"
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Documents/Performance"
    3⤵
    PID:5136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverProxy/Operational"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DriverProxy/Performance"
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-API/Diagnostic"
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Compositor/Diagnostic"
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Core/Diagnostic"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Dwm/Diagnostic"
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Redir/Diagnostic"
    3⤵
    PID:5980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Dwm-Udwm/Diagnostic"
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-Admin"
    3⤵
    PID:5580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-Operational"
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-SysMm/Debug"
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl-SysMm/Performance"
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Contention"
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Diagnostic"
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Performance"
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxgKrnl/Power"
    3⤵
    PID:4700
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Application-Learning/Admin"
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Audit-Regular/Admin"
    3⤵
    PID:800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EDP-Audit-TCB/Admin"
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EFS/Debug"
    3⤵
    PID:120
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EFS/Operational"
    3⤵
    PID:4592
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ESE/IODiagnose"
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ESE/Operational"
    3⤵
    PID:4548
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Analytic"
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Debug"
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapHost/Operational"
    3⤵
    - Clears Windows event logs
    PID:2728
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-RasChap/Operational"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-RasTls/Operational"
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-Sim/Operational"
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EapMethods-Ttls/Operational"
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/EventLog"
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Energy-Estimation-Engine/Trace"
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorClass/Operational"
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EnhancedStorage-EhStorTcgDrv/Analytic"
    3⤵
    PID:816
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventCollector/Debug"
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventCollector/Operational"
    3⤵
    - Clears Windows event logs
    PID:332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
    3⤵
    - Clears Windows event logs
    PID:4484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog/Analytic"
    3⤵
    PID:5796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-EventLog/Debug"
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Analytic"
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Debug"
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FMS/Operational"
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FailoverClustering-Client/Operational"
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FeatureConfiguration/Analytic"
    3⤵
    PID:2412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FeatureConfiguration/Operational"
    3⤵
    PID:392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
    3⤵
    PID:5412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Analytic"
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Catalog/Debug"
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Analytic"
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-ConfigManager/Debug"
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/Analytic"
    3⤵
    PID:3732
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/Debug"
    3⤵
    PID:3840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Core/WHC"
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/Analytic"
    3⤵
    PID:5428
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/BackupLog"
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Engine/Debug"
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Analytic"
    3⤵
    PID:304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-EventListener/Debug"
    3⤵
    - Clears Windows event logs
    PID:2608
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Service/Analytic"
    3⤵
    PID:1236
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-Service/Debug"
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Analytic"
    3⤵
    PID:5708
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileHistory-UI-Events/Debug"
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-FileInfoMinifilter/Operational"
    3⤵
    PID:484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Folder Redirection/Operational"
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Forwarding/Debug"
    3⤵
    PID:5844
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Forwarding/Operational"
    3⤵
    PID:628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GPIO-ClassExtension/Analytic"
    3⤵
    PID:992
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GenericRoaming/Admin"
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-GroupPolicy/Operational"
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HAL/Debug"
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenter/Debug"
    3⤵
    PID:4232
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenter/Performance"
    3⤵
    - Clears Windows event logs
    PID:4964
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HealthCenterCPL/Performance"
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HelloForBusiness/Debug"
    3⤵
    PID:5380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HelloForBusiness/Operational"
    3⤵
    PID:5968
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Help/Operational"
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
    3⤵
    PID:3076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HotspotAuth/Analytic"
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HotspotAuth/Operational"
    3⤵
    PID:5132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HttpService/Log"
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-HttpService/Trace"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Admin"
    3⤵
    PID:2640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Analytic"
    3⤵
    PID:432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Debug"
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Diagnose"
    3⤵
    PID:4396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Guest-Drivers/Operational"
    3⤵
    - Clears Windows event logs
    PID:2288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Admin"
    3⤵
    PID:4348
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Analytic"
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-Hypervisor-Operational"
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-KMCL-Child/Analytic"
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-VID-Admin"
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Hyper-V-VID-Analytic"
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IE-SmartScreen"
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IKE/Operational"
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IKEDBG/Debug"
    3⤵
    PID:5860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-Broker/Analytic"
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CandidateUI/Analytic"
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManager/Debug"
    3⤵
    PID:3692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-CustomerFeedbackManagerUI/Analytic"
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPAPI/Analytic"
    3⤵
    PID:384
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPLMP/Analytic"
    3⤵
    - Clears Windows event logs
    PID:1540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPPRED/Analytic"
    3⤵
    PID:4948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPSetting/Analytic"
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-JPTIP/Analytic"
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-KRAPI/Analytic"
    3⤵
    PID:5880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-KRTIP/Analytic"
    3⤵
    - Clears Windows event logs
    PID:4924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-OEDCompiler/Analytic"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TCCORE/Analytic"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TCTIP/Analytic"
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IME-TIP/Analytic"
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPNAT/Diagnostic"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPxlatCfg/Debug"
    3⤵
    - Clears Windows event logs
    PID:600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IPxlatCfg/Operational"
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IdCtrls/Analytic"
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IdCtrls/Operational"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-IndirectDisplays-ClassExtension-Events/Diagnostic"
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Input-HIDCLASS-Analytic"
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-InputSwitch/Diagnostic"
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Debug"
    3⤵
    - Clears Windows event logs
    PID:4792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Operational"
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Iphlpsvc/Trace"
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KdsSvc/Operational"
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Operational"
    3⤵
    PID:400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos-Local-Key-Distribution-Center/Performance"
    3⤵
    PID:568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kerberos/Operational"
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-AppCompat/General"
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-AppCompat/Performance"
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Analytic"
    3⤵
    PID:708
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Debug"
    3⤵
    PID:1400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ApphelpCache/Operational"
    3⤵
    - Clears Windows event logs
    PID:3296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Boot/Analytic"
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Boot/Operational"
    3⤵
    PID:5512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-CPU-Partition/Analytic"
    3⤵
    PID:5136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-CPU-Starvation/Operational"
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Cache/Operational"
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Disk/Analytic"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Dump/Operational"
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Admin"
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-File/Analytic"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-IO/Operational"
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Interrupt-Steering/Diagnostic"
    3⤵
    PID:5980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-IoTrace/Diagnostic"
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Analytic"
    3⤵
    - Clears Windows event logs
    PID:5580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-LiveDump/Operational"
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Memory/Analytic"
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Network/Analytic"
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PRM/Operational"
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Pdc/Diagnostic"
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Pep/Diagnostic"
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Boot Diagnostic"
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Configuration Diagnostic"
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Enumeration Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:1836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Device Management"
    3⤵
    PID:4264
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Diagnostic"
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-PnP/Driver Watchdog"
    3⤵
    - Clears Windows event logs
    PID:4692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:3668
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
    3⤵
    PID:5436
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
    3⤵
    PID:4796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Process/Analytic"
    3⤵
    PID:4148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Registry/Analytic"
    3⤵
    PID:3720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-Registry/Performance"
    3⤵
    PID:828
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Debug"
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Diagnostic"
    3⤵
    PID:2636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-ShimEngine/Operational"
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Analytic"
    3⤵
    PID:916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Debug"
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WDI/Operational"
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WHEA/Errors"
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-WHEA/Operational"
    3⤵
    - Clears Windows event logs
    PID:816
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Kernel-XDV/Analytic"
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Admin"
    3⤵
    PID:332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Operational"
    3⤵
    PID:4484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-KeyboardFilter/Performance"
    3⤵
    PID:5796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Known Folders API Service"
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-L2NA/Diagnostic"
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LAPS/Operational"
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LDAP-Client/Debug"
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Diagnostic"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Operational"
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LSA/Performance"
    3⤵
    - Clears Windows event logs
    PID:3340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Analytic"
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Debug"
    3⤵
    - Clears Windows event logs
    PID:5824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LanguagePackSetup/Operational"
    3⤵
    PID:1852
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LimitsManagement/Diagnostic"
    3⤵
    PID:5316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Diagnostic"
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LinkLayerDiscoveryProtocol/Operational"
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LiveId/Analytic"
    3⤵
    PID:316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LiveId/Operational"
    3⤵
    PID:2044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-LocationServiceProvider/Debug"
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPEG2-Video-Encoder-MFT_Analytic"
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
    3⤵
    PID:336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-DRV/Diagnostic"
    3⤵
    PID:1360
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MPS-SRV/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:1440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSFTEDIT/Diagnostic"
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSPaint/Admin"
    3⤵
    PID:1044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSPaint/Debug"
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MSPaint/Diagnostic"
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Admin"
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Analytic"
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Debug"
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MUI/Operational"
    3⤵
    - Clears Windows event logs
    PID:2212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/DMC"
    3⤵
    - Clears Windows event logs
    PID:4856
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/DMR"
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Media-Streaming/MDE"
    3⤵
    PID:1212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFCaptureEngine/MFCaptureEngine"
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
    3⤵
    PID:4736
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-Performance/SARStreamResource"
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Minstore/Analytic"
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Minstore/Debug"
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api-Internal/Analytic"
    3⤵
    - Clears Windows event logs
    PID:1776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-Api/Analytic"
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mobile-Broadband-Experience-SmsApi/Analytic"
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MobilityCenter/Performance"
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin"
    3⤵
    PID:988
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Debug"
    3⤵
    PID:2872
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics"
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"
    3⤵
    PID:1280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MosHost/Operational"
    3⤵
    PID:3612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-MosHost/Performance"
    3⤵
    PID:5388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Mprddm/Operational"
    3⤵
    PID:804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NCSI/Analytic"
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NCSI/Operational"
    3⤵
    PID:6060
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
    3⤵
    - Clears Windows event logs
    PID:2464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:5032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NDIS/Operational"
    3⤵
    PID:3408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NTLM/Operational"
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NWiFi/Diagnostic"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Narrator/Diagnostic"
    3⤵
    PID:5076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ncasvc/Operational"
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NcdAutoSetup/Diagnostic"
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NcdAutoSetup/Operational"
    3⤵
    PID:4280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NdisImPlatform/Operational"
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ndu/Diagnostic"
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetShell/Performance"
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-Connection-Broker"
    3⤵
    PID:832
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-ExecutionContext/Operational"
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-Setup/Diagnostic"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkBridge/Diagnostic"
    3⤵
    PID:2112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProfile/Diagnostic"
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProfile/Operational"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvider/Operational"
    3⤵
    PID:1948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvisioning/Analytic"
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkProvisioning/Operational"
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NetworkSecurity/Debug"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Networking-RealTimeCommunication/Tracing"
    3⤵
    - System Time Discovery
    PID:600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NlaSvc/Diagnostic"
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-NlaSvc/Operational"
    3⤵
    PID:4316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/Operational"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/Performance"
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ntfs/WHC"
    3⤵
    PID:6044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLE/Clipboard-Performance"
    3⤵
    PID:1352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLEACC/Debug"
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OLEACC/Diagnostic"
    3⤵
    PID:4792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-FirstLogonAnim/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:4556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-Core/Diagnostic"
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Diagnostic"
    3⤵
    PID:5000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-DUI/Operational"
    3⤵
    PID:1392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OOBE-Machine-Plugins-Wireless/Diagnostic"
    3⤵
    PID:400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Analytic"
    3⤵
    PID:568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Debug"
    3⤵
    PID:5572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/Operational"
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OfflineFiles/SyncLog"
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneBackup/Debug"
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneX/Diagnostic"
    3⤵
    PID:708
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OneX/Operational"
    3⤵
    - Clears Windows event logs
    PID:1400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OobeLdr/Analytic"
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-OtpCredentialProvider/Operational"
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PCI/Diagnostic"
    3⤵
    PID:5512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PCI/Operational"
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ParentalControls/Operational"
    3⤵
    - Clears Windows event logs
    PID:5136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Analytic"
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Debug"
    3⤵
    PID:4920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Partition/Diagnostic"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PerceptionRuntime/Operational"
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PerceptionSensorDataService/Operational"
    3⤵
    - Clears Windows event logs
    PID:4248
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Perflib/Operational"
    3⤵
    PID:5596
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Analytic"
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Diagnostic"
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-Nvdimm/Operational"
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Analytic"
    3⤵
    PID:5980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Diagnostic"
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-PmemDisk/Operational"
    3⤵
    PID:5580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Analytic"
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Certification"
    3⤵
    PID:6092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Diagnose"
    3⤵
    PID:4136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PersistentMemory-ScmBus/Operational"
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PhotoAcq/Analytic"
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PlayToManager/Analytic"
    3⤵
    PID:3920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Policy/Analytic"
    3⤵
    PID:2956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Policy/Operational"
    3⤵
    PID:3880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerCfg/Diagnostic"
    3⤵
    - Power Settings
    PID:4264
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerCpl/Diagnostic"
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Analytic"
    3⤵
    - Clears Windows event logs
    PID:3668
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Debug"
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager/Operational"
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Admin"
    3⤵
    PID:5396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Analytic"
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Debug"
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintBRM/Admin"
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService-USBMon/Debug"
    3⤵
    PID:3496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Admin"
    3⤵
    PID:632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Debug"
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PrintService/Operational"
    3⤵
    PID:296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode/Operational"
    3⤵
    - Clears Windows event logs
    PID:3796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Privacy-Auditing/Operational"
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ProcessStateManager/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:1984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/Analytic"
    3⤵
    PID:4344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Program-Compatibility-Assistant/CompatAfterUpgrade"
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin"
    3⤵
    PID:5300
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot"
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/Debug"
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService"
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Diagnostic"
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Informational"
    3⤵
    PID:404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Proximity-Common/Performance"
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Developer/Debug"
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-InProc/Debug"
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Admin"
    3⤵
    - Clears Windows event logs
    PID:1388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Debug"
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-PushNotification-Platform/Operational"
    3⤵
    PID:5184
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-QoS-qWAVE/Debug"
    3⤵
    PID:308
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC-Proxy/Debug"
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC/Debug"
    3⤵
    PID:4112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RPC/EEInfo"
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RRAS/Debug"
    3⤵
    PID:4492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RRAS/Operational"
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RadioManager/Analytic"
    3⤵
    PID:3684
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Ras-NdisWanPacketCapture/Diagnostic"
    3⤵
    PID:4608
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RasAgileVpn/Debug"
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RasAgileVpn/Operational"
    3⤵
    - Clears Windows event logs
    PID:3324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReFS/Operational"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReFsDedupSvc/Operational"
    3⤵
    PID:4152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoost/Analytic"
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoost/Operational"
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-ReadyBoostDriver/Operational"
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-Regsvr32/Operational"
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
    3⤵
    PID:484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteApp and Desktop Connections/Operational"
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Admin"
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Operational"
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteAssistance/Tracing"
    3⤵
    PID:628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
    3⤵
    PID:992
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Debug"
    3⤵
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 > nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\baj.exe" & del "C:\Users\Admin\AppData\Local\Temp\baj.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2216
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:684
- - C:\Windows\SysWOW64\fsutil.exe
    fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\baj.exe"
    3⤵
    PID:1304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Users\Admin\AppData\Local\Temp\baj.exe
C:\Users\Admin\AppData\Local\Temp\baj.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

a7k9p2q-ReadMe.txt

Path C:\Program Files (x86)\a7k9p2q-ReadMe.txt
Size 918B
SHA256 b91da53f19c6d28c28830fd652be52f9ef0cea09fd28e10e79a8b0fb1d9283a0
MD5 8eae69f2768f044c13eefa04583a8f65
SHA1 abedb0896a163e8b6d718593af2bf133ae73ecb0
SHA512 000e196b62ec55d6b2f8e192c2544e7eb48a011fd7f4e470ef328d1a4b0134d06f46608f34dae5ce08e21719eb1530a7834c0fd8b1fe9d3020cae3d027c1b34d
TLSH
T1C111142AAF00B12149A117D4B16DF8619F57F1C8EA7A38129D5D11C8532CF6768DB060
MD5 SHA1 SHA512 TLSH

Submit Download

Culture.tmp

Path C:\ProgramData\Culture.tmp
Size 5KB
SHA256 a6c41f368f42a7c57c307a48ce2440a60a744226b6414fadb6517a80a5d160a2
MD5 ab65af4349e7c5b0872c8b808d036980
SHA1 414b2a2748b7ea6176c1d2453f89fdc8a2d349d0
SHA512 2c61c56e8c299677bad4ce223e3187200c341aa4dd4503fac1217aa8e15687af03544a6d160bb2b1b131a56ea9df2967e00359aa622f12d1b82605c40cca6679
SSDEEP 96:5yCx9DNAHK/YTY2m7hY2mMY27a0htV+MDsx:5yCxf/YIa0hb+M
TLSH
T1B2B1C8418A784763F27D43FC19EED90D5A7AD0E0473626F7257689594FC06007816F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-0-0x0000000000060000-0x0000000000096000-memory.dmp

Download

memory/1028-1-0x0000000000095000-0x0000000000096000-memory.dmp

Download

memory/1028-2356-0x0000000000060000-0x0000000000096000-memory.dmp

Download

memory/1028-2738-0x0000000000060000-0x0000000000096000-memory.dmp

Download

memory/1028-6451-0x0000000000060000-0x0000000000096000-memory.dmp

Download

memory/1028-10724-0x0000000000060000-0x0000000000096000-memory.dmp

Download

memory/1028-10734-0x0000000000060000-0x0000000000096000-memory.dmp

Download

memory/4116-1315-0x0000000000060000-0x0000000000096000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads